SOC 2 report review that reads past the opinion, gives every user-entity control an owner and waits for you to sign
Exceptions weighed and every user-entity control owned before the SOX year-end test.
See one case, screen by screen ↓SOC Report Review is SOC 2 and SOC 1 report review software for vendor risk and SOX teams. Seven AI agents read each vendor SOC report twice and cite every fact to its page, join each complementary user entity control (CUEC) to a control you own and ask its owner to confirm, weigh the auditor's exceptions against your side, trace carved-out subservice providers and draft the bridge-letter request. The vendor risk analyst concludes and signs with a reason code.
How to choose AI solutions for back-office and enterprise work →
Updated
Every SOX filer and regulated company collects its vendors' SOC 1 and SOC 2 reports each year. A full read takes hours, so many reviews read the auditor's opinion and file the PDF. The risk sits further in: exceptions in the tests-of-controls table, services you use that the system description does not cover, subservice providers carved out of scope, and a report period that stops months before your fiscal year ends.
Then there are the complementary user entity controls: the controls the vendor says you must run. They are copied into a spreadsheet, the owner changes in a reorganisation, a control is retired, and the CUEC is left with nobody behind it. A CUEC nobody owns is your own control gap, and for a SOX vendor it becomes your deficiency at the year-end SOX test.
Estimated split for one vendor SOC report, by hand and with the solution: about two hours to read a report (published guide), the rest our estimate.
Seven agents read, check, map, trace and chase; the vendor risk analyst concludes and owners confirm their controls.
Kestrel & Vane Group is US-listed, so a SOX filer, with a calendar fiscal year. Tallowmere Payroll Inc. runs its US and Canada payroll: 11,860 employees, about $1.12B gross pay a year, a critical, SOX-relevant vendor. Its SOC 2 Type II arrived through Tallowmere's trust portal on Monday 12 October. On Wednesday morning Kenji Watanabe, vendor risk analyst, works through it with the agents. This is that morning, screen by screen, in the working solution.
Kenji's day opens on what needs him, not on a chart: 7 reviews of his own, 4 loose ends in them, 4 requests waiting on others and 13 vendor reports overdue. At the top of the list is Tallowmere Payroll: "2 CUECs with no owner · 1 fact to confirm · bridge letter drafted". Beside it, each agent says in a line what it did between 07:03 and 07:08.
Agents overnight: “Second reader · Re-read independently: 41 of 42 facts agree; CC8.1 population differs (1,184 / 1,148).”
The report reader read all 94 pages. Across the top: opinion qualified on CC6.2 (p.5), Type II covering 9 months from 1 Jan to 30 Sep 2026, 1 service outside the scope (p.11), 3 subservice providers carved out (p.38), a 92-day fiscal-year gap, 3 exceptions and 14 CUECs, 2 of them loose. Below, the vendor's CUECs on the left are joined by lines to Kestrel & Vane's own controls on the right, and the auditor's exceptions sit beside them as cards.
“Compound risk. The auditor's CC6.2 exception (Tallowmere leavers kept access) and CUEC-06 (nobody tells Tallowmere when our portal administrators leave) are two weak points on the same door.”
Every figure on the review carries its page. Kenji clicks p.5 and the report opens at Section 1, the opinion, with the basis for qualification highlighted: 3 of 25 terminations sampled where access was not removed within one business day. The original PDF is kept unchanged and can be downloaded.
“Both readers cite this page · original PDF kept unchanged.”
A second agent read the whole report again on its own, never from the first reading. Of 42 facts, 41 agree. On the CC8.1 change-management population the report reader found 1,184 in the test table (p.72), the second reader 1,148 in the narrative (p.73). Kenji picks 1,184, the auditor's own population, and the note for the record goes on the audit trail.
“The test table is the auditor's tested population; the narrative is management's description.”
CUEC-06 asks Kestrel & Vane to notify Tallowmere of terminated client administrators within one business day (p.45). No control in the library covers it: the leaver checklist HR-OFF-03 covers internal systems only. The mapper proposes Joel Bergström, who owns HR-OFF-03 and the HR system feeds, at 71% confidence, and a new control, HR-OFF-07. Kenji asks Joel to confirm; Joel confirms in Teams at 09:30. CUEC-11, left without an owner when PAY-07 was retired, goes the same way to Amara Osei, who confirms PAY-11 at 09:34.
“The owner is asked in Teams and email, due in 3 business days. Only the owner can confirm; the agent cannot.”
CC6.2 is rated High. The auditor inspected 25 of 212 terminations: for 3 of 25, access was removed after 11, 19 and 34 days, and two of the three held production access to client payroll data (p.61). Management says automated deprovisioning from the HR system went live on 14 Aug 2026, not tested by the auditor (p.91). It touches the personal and bank data of 11,860 employees, it came back from the 2025 report (1 of 25), and it is linked to CUEC-06 on our side.
The exception assessor never accepts a risk or softens a qualified opinion.
The report stops on 30 September; the fiscal year ends on 31 December. That leaves 92 days, exactly at the limit a bridge letter may cover. The agent drafted the request to Dana Moreau, Tallowmere's Director of Compliance: signed by Tallowmere management, not the auditor, confirming no material changes, no known control failures, that automated deprovisioning operated throughout, and any change in subservice providers. Due Friday 15 January 2027, before the reliance memo on 29 January.
“Drafted by the gap agent · nothing is sent until you press Send.”
With no loose ends left, Conclude opens. The agents suggest Rely with conditions, and Kenji keeps it: reason code RC-03, qualified opinion, compensating controls in place; residual risk Medium. Five conditions: the bridge letter by 15 Jan 2027; HR-OFF-07 and PAY-11 operating from the November pay run; ITGC-AC-12, the quarterly review of Tallowmere staff with access to payroll data, as the compensating control; the Quillmark Print & Mail report and Fernway Identity's newer one; Time & Attendance in the 2027 scope.
“I read the exceptions, the readings and the mapping, and I sign as Kenji Watanabe.”
The review reads "Concluded · Rely with conditions", with 14 of 14 CUECs owned. As he signs, the three prepared requests go to Dana Moreau: the bridge letter, evidence that deprovisioning works since 14 August, and the two fourth-party reports. Because the opinion is qualified on a SOX vendor, Lucía Ferreira, IT controls and SOX lead, is asked to acknowledge the SOX impact.
“Signed · Rely with conditions · RC-03.”
Every step of the morning is on the audit trail with its evidence: the readers' disagreement resolved at 09:26, each owner asked and each confirmation, the bridge letter sent under rule R-4, and the conclusion with its five conditions. Each record is chained to the one before; the internal auditor verifies the chain and exports an evidence pack.
“Chain unbroken. 18,442 records checked; each record's fingerprint matches the one before it.”
The same Tallowmere report, seen by the five people it reaches: how their year-end used to go, and how it goes now.
Seven agents read, check, map, trace and chase; the vendor risk analyst concludes and owners confirm their controls.
Reads each SOC report: opinion, service auditor, type, period, categories, scope, exceptions, CUECs and subservice organisations, every fact with its page.
Reads the same report again on its own and compares every fact; sends any disagreement to the analyst with both readings side by side.
Compares the services, modules and locations in the system description with the contract and what the group actually uses.
Rates each exception for Kestrel & Vane, finds recurrence from last year's report and compound risk with the CUECs, and reads the management response.
Maps each CUEC to a control in your library with a confidence and a reason, proposes owners from the HR directory, asks them to confirm, flags CUECs new or reworded since last year, and checks nightly for retired controls and leavers.
Finds each carved-out provider's own report, checks its period and opinion against the controls the vendor relies on, and counts concentration across the portfolio.
Works out each report's period gap against the fiscal year and SOX dates, drafts bridge-letter, evidence and missing-report requests, reminds on the service level and reads the replies.
Concludes and signs with a reason code. The agents propose; a named person decides.
Ask about any vendor, SOC report, exception or user-entity control, or say what to chase. Every answer cites its page, and anything drafted waits for a person to send or sign.
Which SOX vendors have user-entity controls nobody owns?
38 CUECs have no owner, across 17 vendors. In your queue: Tallowmere Payroll has 2 (CUEC-06 leavers, CUEC-11 payroll change report), Corvid Freight Audit 1 and Velmont Card Services 1. The other 34 lost their owner after review. Each has a proposed owner; the register is open, filtered to them.
Is Tallowmere's report enough for our year-end?
Not on its own. The SOC 2 Type II covers 1 Jan–30 Sep 2026, so 92 days of your fiscal year are uncovered: exactly the 3-month limit in rule R-4. The opinion is qualified on CC6.2: 3 of 25 leavers kept access for 11–34 days. You need a bridge letter signed by Tallowmere management for 1 Oct–31 Dec, confirming the automated deprovisioning of 14 Aug kept working; due 15 Jan 2027, before the reliance memo on 29 Jan.
Which fourth parties do most of our vendors depend on?
Nimbuscore Cloud Hosting sits behind 14 of your vendors, including Tallowmere; its own SOC 2 Type II runs to 30 Jun 2026, unmodified. Next: Stratavault Hosting (11) and Ironleaf Data Centres (9). Of 96 carved-out providers, 14 have only stale reports and 11 have none on file.
Draft reminders for every overdue SOC report
13 vendor reports are overdue, the oldest 41 days (Halberd Card Services). I drafted 13 reminders, each with the report you expect, the period and the contract clause that requires it. Nothing is sent until you press Send: the drafts are in Requests.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules every report is checked against are settings, saved as a new version for the Head of Vendor Risk to approve and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| R-1 · Review target, critical vendors | 10 business days from receipt | Any number of business days |
| R-2 · Review target, high vendors | 15 business days | Any number of business days |
| R-3 · Report is stale after | 12 months from the period end | Any number of months |
| R-4 · Longest gap a bridge letter may cover | 92 days; longer needs extra procedures | Any number of days |
| Type I not accepted for critical vendors | On · request a Type II | On · Off |
| Ask for a bridge letter automatically 60 days before year-end | On · drafted for the analyst to send | On · Off |
| Lowest confidence to propose a mapping | 70 | Any level; below it the CUEC stays loose with the reason |
| Conclusion reason codes | RC-01 to RC-05 | Unmodified, no relevant exceptions · Exceptions not relevant to us · Qualified opinion, compensating controls in place · Scope gap covered by our own procedure · Do not rely, extra procedures planned · add a code |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample vendor data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (54.9% of reports with at least one exception and 12.5 CUECs a report: CBIZ 2024 SOC Benchmark Study; about two hours to read a SOC 2 report: a 2026 SOC 2 review guide from a vendor-risk software company). Carve-out and inclusive methods: AICPA AT-C 205 and AT-C 320. Kestrel & Vane Group, its vendors, auditors and the people named on this page are fictional: characters and sample data in the working solution.
SOC Report Review is SOC 2 and SOC 1 report review software for vendor risk and SOX teams. Seven AI agents read each vendor SOC report twice and cite every fact to its page, join each complementary user entity control (CUEC) to a control you own and ask its owner to confirm, weigh the auditor's exceptions against your side, trace carved-out subservice providers and draft the bridge-letter request. The vendor risk analyst concludes and signs with a reason code.
The CUEC mapper joins each CUEC to a control in your own library with a confidence and a reason. Where no control covers one, it stays a loose end with a proposed owner from the HR directory and a proposed control, and the owner is asked in Teams and email. Only the owner can confirm, and a review cannot close with an unowned CUEC unless the Head of Vendor Risk accepts the risk.
The gap and follow-up agent works out the uncovered days against your fiscal year and drafts a bridge-letter request: the period it must cover, that vendor management signs it, what it must confirm and the due date before your reliance memo. A gap longer than your limit (92 days in the sample rules) is escalated so the SOX lead can plan extra procedures.
Yes. The subservice tracer finds each carved-out provider's own report, checks its period and opinion, marks it current, stale or missing, and drafts the request for what is missing. Across the portfolio it shows concentration, such as one hosting provider behind 14 vendors.
Every fact on the review cites its page, and a second agent reads the whole report again on its own. The two readings must agree; any disagreement goes to the analyst with both side by side, and the choice is recorded. In the sample review, 41 of 42 facts agreed and the analyst settled the other.
Yes. It reads SOC 1 and SOC 2 reports, Type I and Type II, and catches the wrong document at intake, such as a SOC 3 or a Type I for a critical vendor. Conclusions on SOX vendors feed a reliance view for the external auditor, with the key controls relying on each report and an exportable reliance memo.
Yes. The agents read, map, draft and chase; they never conclude a review, accept a risk, mark a CUEC confirmed or send to a vendor. The analyst concludes and signs, owners confirm their CUECs, the SOX lead acknowledges qualified opinions on SOX vendors and the Head of Vendor Risk signs any “do not rely”.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your control library, vendor inventory, last year's reviews and a sample of SOC reports, and it goes live once every quality gate has passed. We will walk you through it on your own reports first.
Missing audit, exit and subcontracting clauses fixed before renewal, not at inspection.
1-min demoSupply Chain Due DiligenceDetained goods released with a trace to the raw material, every link proved.
1-min demoSupplier Sanctions ScreeningNo payment reaches a supplier blocked through its owners; every alert brings its evidence.
1-min demoWe'll run SOC Report Review on a sample of your own vendor SOC reports and last year's reviews.