How we grade a SOC 2 Type II report
This score reflects whether the report contains the elements a SOC 2 Type II report should, and whether each is adequate against its cited standard. It is a completeness and consistency check, not an audit opinion.
The Grader currently grades SOC 2 Type II reports. Type 1 reports are not graded.
Methodology version soc2-type2-v2.1Published on October 7, 2026
This is not an AICPA peer review, audit opinion, or compliance certification. It is an automated review powered by AI that checks this report against the cited standards. It is not an assessment of the issuing firm.
The grader checks the report. Audora runs the engagement behind it.
Testing, evidence review, and workpapers in one place, so control, criterion, test, and result line up before anyone drafts the report. Built by auditors, for auditors. Run a real engagement in a free sandbox.
Authoritative standards
Every checklist item is tied to one of the authoritative sources below. We check whether the report contains what these standards require, not whether the underlying controls are effective.
- AT-C 105. AICPA AT-C 105, Concepts Common to All Attestation Engagements
- AT-C 205. AICPA AT-C 205, Examination Engagements
- DC 200. Description Criteria DC 200 (DC1 through DC9)
- TSP 100. Trust Services Criteria TSP 100 (Security, Availability, Processing Integrity, Confidentiality, Privacy)
- SOC 2 Guide. AICPA SOC 2 Reporting Guide, including Supplement B
How each element is scored
The grader marks each of the 22 elements with one state. All the math runs in code, not in the model, so the result is deterministic and explainable.
Present and adequate
The element is present and complete or consistent against its cited standard.
Present with a minor gap
The element is substantively present and adequate, with one small, non-material omission.
Present but inadequate
The element is present but a placeholder, boilerplate, incomplete, or internally inconsistent.
Not found
The element is absent. Silence is a flag, never an inferred pass.
Sections and weights
Each section score is the average of its element points. The overall score is the weighted average below. Section D (tests of controls) carries the most weight because it is the core of a Type II report.
Grade bands
Grade A: 90 to 100
Grade B: 80 to 89
Grade C: 70 to 79
Grade D: 60 to 69
Grade F: below 60, or any critical element not found or present but inadequate.
The critical gate
Six elements are structurally critical. If any one of them is not found, or is present but inadequate, the grade is capped to a Grade F regardless of the numeric score, because a core requirement of a SOC 2 Type II report is then missing or unreliable.
The role of AI
The report is read by an AI model running in our own cloud account at temperature zero, which makes its classifications as consistent as possible. The model only classifies each element and quotes supporting evidence. It never computes the score. The specific model is not disclosed and may change over time.
An example
A report with strong coverage but one non-critical present-but-inadequate element and no critical issues scores 88, which lands in Grade B. The same report with a single critical element not found - or merely present but inadequate - would be capped to a Grade F no matter how high the numeric score.
The full checklist
A. Service auditor's report & opinion
A1 Independent service auditor's report present, properly titled and addressed
Source: AT-C 205, AICPA SOC 2 Guide
A distinct, titled independent auditor's report, addressed to the service organization, is present - not folded into another section.
A2 Opinion type explicit - unmodified / qualified / adverse / disclaimer; no hedging language without a stated qualification
CriticalSource: AT-C 205
One of the four opinion types is stated in explicit opinion language; no undefined hedging ("generally," "substantially") without a matching qualification.
A3 Opinion addresses (a) description per DC, (b) suitability of design, (c) [Type 2] operating effectiveness - "based on the applicable trust services criteria"
CriticalSource: AT-C 205, DC 200
The opinion names all applicable subjects - description, suitability of design, and (Type 2) operating effectiveness - each "based on the applicable trust services criteria".
A4 Scope stated - period of coverage (Type 2) or as-of date (Type 1); in-scope TSC categories named
CriticalSource: AICPA SOC 2 Guide, DC 200
An explicit period (Type 2) or as-of date (Type 1) appears and the in-scope categories are named; dates agree between cover and opinion.
A5 Management's written assertion included in the report
CriticalSource: AT-C 205, AICPA SOC 2 Guide
A management assertion section is physically present and attributed to the service organization.
A6 Restricted-use / specified-parties alert present
Source: AT-C 205
A restricted-use / specified-parties paragraph is present.
A7 Auditor identified - firm, city & state, signature, and report date
Source: AT-C 105 & 205
Firm name, city & state, a signature / attribution, and a report date all appear together at the opinion. A bare city/state + date, with the firm named only in a logo or body text rather than the signature block, is inadequate.
B. System description
B1 Types of services provided
Source: DC 200 (DC1)
The specific service(s) in scope are named - not a generic "we provide services" placeholder.
B2 Principal service commitments & system requirements
Source: DC 200 (DC2)
Both principal service commitments and system requirements are stated - not one without the other.
B3 System components - infrastructure, software, people, procedures, data - and system boundaries
Source: DC 200 (DC3)
All five component types (infrastructure, software, people, procedures, data) are substantively described (not one-line boilerplate) and the system boundary is stated. Generic filler that names a component without describing it is inadequate.
B4 Identified system incidents - nature, timing, extent / disposition; or a statement that none occurred
Source: DC 200 (DC4)
Incidents are described with nature, timing, and extent / disposition - or an explicit "none" statement appears.
B5 Applicable trust services criteria and the related controls
Source: DC 200 (DC5)
The applicable criteria are identified and a controls section lists controls against them.
B6 Complementary user entity controls (CUECs), where applicable
Source: DC 200 (DC6)
CUECs are listed where reliance is indicated - or the report states none are required.
B7 Subservice organizations - inclusive vs. carve-out method; CSOCs identified
Source: DC 200 (DC7)
If a subservice org is named, the method (inclusive / carve-out) is stated and CSOCs are identified for carve-out; if none, that is stated.
B8 Any applicable TSC deemed not relevant, with the reason
Source: DC 200 (DC8)
Any not-relevant criterion carries an explicit reason - not a silent omission.
B9 [Type 2] Significant changes to the system during the period; or a statement of none
Source: DC 200 (DC9)
Significant changes during the period are described, or an explicit "no significant changes" statement appears. A non-answer that does not address changes (e.g. "this is the first audit") is inadequate.
C. Trust services criteria coverage
C1 In-scope TSC categories explicitly named (Security required; Availability / Processing Integrity / Confidentiality / Privacy as applicable)
CriticalSource: TSP 100, DC 200
Security appears and every additional in-scope category is named explicitly.
C2 Each applicable criterion addressed by at least one mapped control
Source: TSP 100 (DC5)
Each applicable criterion (CC1.1-CC9.2 plus the criteria for every in-scope category: A / PI / C / P) has at least one control mapped AND tested. If an in-scope category is named but its criteria carry no mapped/tested controls, that is inadequate.
C3 Criteria deemed not relevant are explained (ties to DC8)
Source: DC 200 (DC8)
Any excluded criterion carries a stated reason.
D. Tests of controls
D1 Service auditor's tests of controls described (nature of the procedures)
Source: AT-C 205, AICPA SOC 2 Guide
The tests describe procedures actually performed: the mix of inquiry / observation / inspection / re-performance PLUS concrete specifics (sample size or population, the named artifact, who was inquired, dates in-period). A results column that only restates the control ("Inspected [X] to determine that [the control]") for substantially every control, with no sampling or specifics, is boilerplate -> inadequate.
D2 Results of tests stated; exceptions / deviations disclosed, or "no exceptions noted"
CriticalSource: AT-C 205, AICPA SOC 2 Guide
Each control carries a result that is consistent with its control and reflects testing over the examination period; exceptions are disclosed, or an explicit "no exceptions noted" appears. Results that are internally inconsistent (a note referencing an unrelated control, a copy-paste mismatch), or where operating effectiveness is not exercised in-period ("no events to test", evidence dated before/after the period) for a material share of controls, are inadequate.
D3 Detail sufficient to tie control -> applicable criterion -> test -> result
Source: AICPA SOC 2 Guide
Each control traces to an applicable criterion and to a test and result, and the three correspond to one another. Mismatched or copy-pasted cells (a result that does not match its control) break the trace -> inadequate.