Review a vendor's SOC report and map complementary controls
Reviews a service provider's SOC 1 or SOC 2 report for scope, exceptions, and the controls my organization must operate itself.
The prompt
Help me review a service organization's SOC 1 or SOC 2 report.
Vendor and the service they provide to us: [DESCRIPTION]
Why we rely on them: [e.g. financial reporting impact for SOX, customer data security]
Report details: [type (SOC 1/SOC 2), Type I or II, period covered, auditor, opinion]
Report sections: [PASTE the scope, system description, exceptions, complementary user entity controls (CUECs), and subservice organizations - or summarize]
Our fiscal year or reliance period: [DATES]
Review and return:
1. Scope fit - does the report cover the services, systems, and locations we actually use? Gaps?
2. Opinion - unqualified, qualified, or adverse, and what it means for reliance.
3. Period coverage - gap between the report period end and our period end; is a bridge (gap) letter needed?
4. Exceptions - table: Control, Exception noted, Management response, Impact on us, Follow-up needed.
5. Subservice organizations - carved out or inclusive; whether we need their reports too.
6. CUEC mapping - table: CUEC, Our control that addresses it, Control owner role, Tested? (Y/N), Gap.
7. Conclusion - can we rely on it, rely with additional procedures, or not rely; and the follow-up list for the vendor.
Base everything on the report content I provide. Mark anything I have not given you as [CHECK REPORT].
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- DESCRIPTION
- DATES
- CHECK REPORT
How this prompt is built
This prompt follows the RTF structure (Role, Task, Format). RTF tells the model who to be, what to do and what shape the answer should take. It is the quickest structure that still gives noticeably better results than a bare request.
Related prompts
- Review a subcontract for risky construction clausesA clause-by-clause review of a subcontract flagging pay-if-paid, indemnity, delay, and flow-down risks, with negotiation asks.
- Audit my law firm's marketing for attorney advertising rule risksReviews ads, web pages, emails, and social posts against lawyer advertising and solicitation rules and gives compliant rewrites.
- Respond to a shipper's cargo loss or damage claimAssesses a freight claim against liability rules and contract terms, then drafts a clear acceptance, partial offer, or denial.
- Write up quality system audit findings against ISO 9001 or IATF 16949Clear, evidence-based audit findings with clause references, graded nonconformities, and a summary for management review.