How to review an accounting provider's SOC 2 report

An accounting provider's security badge gives you a question to investigate: which service, systems, and organization did the examination cover? Ask for the actual report through the provider's permitted review process. Check the legal entity against the company signing your engagement and the product your team will use. A report covering a software platform does not automatically establish how a separate bookkeeping firm manages downloaded payroll files.

AICPA describes SOC reports as a way to obtain information about controls at service organizations. Use the report alongside your own assessment of the proposed work. Record whether the provider will access bank statements, employee information, customer records, tax documents, or payment tools. That inventory tells your reviewer where a gap would have a practical consequence. A general badge without an identifiable report leaves those questions open.

Have someone familiar with assurance reports identify the examination type, date or period, system description, criteria covered, and auditor's opinion. Ask what changed after the period ended. A new document portal, acquired service team, or changed hosting arrangement may need separate evidence. Do not treat a later sales presentation as an extension of the auditor's work.

Mark the services you will actually buy against the report's boundary. For example, the portal may be covered while a payroll subcontractor has its own controls and reporting. Identify exclusions and dependencies instead of assuming the brand name covers every service. If the report is confidential, follow its distribution restrictions and keep a concise internal review record that does not reproduce restricted detail unnecessarily.

Ask your reviewer to explain any relevant exceptions in ordinary operational terms. If a departed employee's access was removed late, find out which systems were affected, how the issue was corrected, and what evidence supports the correction. The decision should reflect the exposure and response, not the number of reassuring pages in the report.

Keep the accounting workflow in view. A control weakness around document access has different consequences from a delayed review of a nonfinancial internal system. Write down the specific data or action at risk, any remaining uncertainty, and the person accepting that uncertainty. Request proportionate follow-up evidence. Avoid demanding unrelated confidential materials simply to make the due-diligence folder look comprehensive.

Ask the provider to identify responsibilities that remain with your business. These may include approving users, protecting your own devices, supplying accurate data, reviewing statements, and authorizing payments. Put them into the onboarding plan with named owners. The FTC's security guidance emphasizes sensible access limits and appropriate safeguards for service providers; a report does not perform those daily tasks for either party.

Consider a bookkeeper who prepares a vendor payment list. Your company still needs to decide who verifies changes to bank details and who releases funds. Give accounting staff only the access required for the engagement. Review the role when their work changes. A sound report on the provider's systems will not correct an owner sharing a banking password through an email thread.

For each material question, record the answer, supporting document, review date, owner, and open action. Distinguish an accepted limitation from a missing answer. An internal reviewer should be able to see why access was approved and what must happen before a broader service starts. This record is more useful than an undifferentiated collection of certificates and screenshots.

Escalate issues according to the proposed exposure. Read-only access to a limited ledger export and administrator access to payroll deserve different approval decisions. Where your team lacks assurance or security expertise, bring the relevant reviewer into the process before sending sensitive records. NIST's Cybersecurity Framework can help organize the risk discussion, but it does not replace assessment of this provider and your actual relationship.

Agree how the provider will tell you about material changes to systems, subcontractors, or the service. Schedule the next evidence review and record who requests the next report. Revisit access when adding payroll, tax preparation, additional entities, or payment support. An approval for the original bookkeeping scope should not silently expand with every new task.

At renewal, compare outstanding actions with their promised completion evidence. At departure, retain the accounting records you need and remove access through a documented handover. The useful result of the review is an informed access decision with clear responsibilities and follow-up dates. No report establishes that a provider can never experience an incident, and this guide makes no claim that any named accounting company holds a particular certification.