Once a firm issues a SOC 2 Type II report, it goes out into the world. The company that received it sends it to its customers, and their security teams read it closely, looking for anything missing. A peer reviewer may read it too, sometimes a year later.
Before we built the Audit Report Grader, we talked with more than 30 audit firms. One request kept coming up: firms wanted a way to show clients what a sound report contains and how it measures up to the standards, without walking them through the guidance page by page. This week we released the grader to do that. It’s free, and it checks one issued SOC 2 Type II report at a time.
Every finding comes with its source
We set one rule early: the grader doesn’t get an opinion of its own. Each finding points to the requirement it’s based on, whether that’s AT-C 105, AT-C 205, DC 200, TSP 100 or the AICPA SOC 2 Guide. If it marks something down, you can read the requirement and judge for yourself.
Auditors are right to be wary of a tool that grades their work on its own say-so. We’re auditors, and we would be too. That’s why the full methodology is public. If you think we’ve read a standard wrong, tell us the element and where your report covers it. If you’re right, we’ll fix it in the next version of the methodology.
What it looks at
The grader checks 22 elements across four parts of the report, and each part counts toward the score:
- The auditor’s report and opinion, 20%: the type of opinion, its scope, management’s assertion, the restricted-use alert and who the auditor is.
- The system description, 15%: the nine description criteria in DC 200, covering things like services and commitments, subservice organizations and changes during the period.
- Criteria coverage, 15%: whether the categories in scope are named, every applicable criterion is addressed and any exclusions are explained.
- Tests of controls, 50%: whether each test is described in enough detail, the results are stated, and every control traces to a criterion, a test and a result.
Tests of controls get half the weight because in a Type II report, they’re the evidence the rest of the report depends on.
Six elements are critical: the type of opinion, what the opinion covers, the scope and period, management’s assertion, the categories in scope and the test results. If any one of them is missing or inadequate, the grade is capped at F, however well the rest of the report scores.
An AI model running in Audora’s own cloud account reads the report, assesses how well each element is covered and quotes the passage it relied on. It’s configured to produce consistent results from one run to the next. The score is calculated in code from those assessments, not by the model.
What the feedback firms told us
Before launch, several audit firms ran a few of their actual reports through the grader and walked us through what they saw. A few points came up across all of them:
- It works best as a check before QC. Most findings were either something a firm planned to fix next cycle or something that didn’t apply to that engagement. Firms saw it as an extra review step before a report reaches quality control, and as one more way to show a peer reviewer how they control report quality.
- The explanations mattered as much as the score. Every score comes with the reason and the passage behind it. Firms also got suggestions on items that scored full marks, where wording could be misread by someone outside the engagement.
- They found uses we hadn’t led with. Firms plan to use it to review a prospect’s prior-year report while scoping a new engagement, and to check reports they rely on as a user entity, such as subservice organization reports.
- They told us where it was too strict. Some checks penalized common practice, such as standard “no exceptions noted” wording, and we adjusted them before launch.
If you’re an audit firm
A few ways to put it to work:
- Grade last year’s report for a client before fieldwork starts, so you go in knowing where it was thin.
- Run reports from two engagement teams and compare them against the same 22 elements.
- Take the findings into your next review meeting. Each one comes with its citation, so the discussion starts from the requirement.
Start on the Audit Report Grader page for audit firms.
If your company holds a SOC 2 report
Run it before your customers’ security teams do. You’ll see which parts of the report are complete and which might draw questions. Take anything that comes up to the firm that issued the report. They wrote it, and they can tell you how each element was handled and whether anything should change next cycle.
Start on the Audit Report Grader page for SOC 2 report holders.
What it doesn’t do
The grader isn’t an AICPA peer review or an audit opinion, and it doesn’t assess the firm that issued the report. It also doesn’t test whether the controls work. A report can be complete and still disclose exceptions; the grade shows whether those exceptions are stated clearly. Grades go only to the person who uploaded the report, and we don’t publish grades or scorecards.
Where Audora fits
A grade tells you about one report. Getting every report to that level depends on how the engagements behind them are run: the same scoping, workpapers and review standard on every one, whoever is staffed. That’s the work the Audora platform does, and the grader is built to run inside it.
See how Audora runs an engagement
The Audit Process Benchmark is three calls or fewer, with free sandbox access to run a real engagement in Audora.
