# Review a vendor's SOC report and map complementary controls

Reviews a service provider's SOC 1 or SOC 2 report for scope, exceptions, and the controls my organization must operate itself.

- Topic: Legal & Compliance
- Framework: RTF
- Level: Standard
- Tags: Legal, Summarize, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/review-a-vendor-s-soc-report-and-map-complementary-controls

## Prompt

```text
Help me review a service organization's SOC 1 or SOC 2 report.

**Vendor and the service they provide to us:** [DESCRIPTION]
**Why we rely on them:** [e.g. financial reporting impact for SOX, customer data security]
**Report details:** [type (SOC 1/SOC 2), Type I or II, period covered, auditor, opinion]
**Report sections:** [PASTE the scope, system description, exceptions, complementary user entity controls (CUECs), and subservice organizations - or summarize]
**Our fiscal year or reliance period:** [DATES]

Review and return:
1. **Scope fit** - does the report cover the services, systems, and locations we actually use? Gaps?
2. **Opinion** - unqualified, qualified, or adverse, and what it means for reliance.
3. **Period coverage** - gap between the report period end and our period end; is a bridge (gap) letter needed?
4. **Exceptions** - table: Control, Exception noted, Management response, Impact on us, Follow-up needed.
5. **Subservice organizations** - carved out or inclusive; whether we need their reports too.
6. **CUEC mapping** - table: CUEC, Our control that addresses it, Control owner role, Tested? (Y/N), Gap.
7. **Conclusion** - can we rely on it, rely with additional procedures, or not rely; and the follow-up list for the vendor.

Base everything on the report content I provide. Mark anything I have not given you as [CHECK REPORT].
```

## What to fill in

- DESCRIPTION
- DATES
- CHECK REPORT

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.