Reading a SOC 2 properly: what do you look at first?

I read a lot of SOC 2 reports and I have concluded that most people, including me until recently, read them wrong. The opinion page is where everyone starts and it is the least informative part.

What I look at now, in order: the scope section, whether the systems I care about are actually in it, the exceptions, the complementary user entity controls, and the period covered relative to today. A clean report for a scope that excludes the product you are buying is worth nothing.

Complementary user entity controls is the one people skip and it is often where your actual obligations hide. I have seen reports where the vendor's control effectiveness depends on the customer doing something nobody at the customer was ever told about.

Add the subservice organisations and whether they are carved out or inclusive. A carve-out means their cloud provider's controls are not covered by this report at all, which changes what you are being shown.

And check the report period. A report covering a window that ended nine months ago is a historical document.

We built a one-page checklist from exactly these points and gave it to procurement so the first pass does not need a security person. It has cut our review queue in half and the questions that reach us are better ones.