Accepting supplier SOC 2 and ISO 27001 reports: when is a report enough to approve a supplier?

This piece grew out of conversations between practitioners on Reddit about whether a supplier's ISO 27001 certificate or SOC 2 report can replace a security questionnaire. One answer stood out: check that the certificate scope covers the service you are buying. We listen to these discussions to share what is being talked about and to add to the conversation. The reader will learn what to read in each document, and when a report is enough to put a supplier on an approved supplier list and when it is not.

A supplier security report is evidence about a defined scope and a defined period. It is not a verdict on the supplier.

Why a supplier report is evidence and not a verdict

An approved supplier list records the suppliers a manufacturer has decided it can buy from. The decision belongs to the manufacturer. An ISO 27001 certificate or a SOC 2 report tells it that an independent party assessed a supplier's information security controls. It does not say whether those controls fit the service the manufacturer uses, the data it sends or the risk it can accept.

The same logic runs through ISO 9001. Clause 8.4 expects an organisation to set criteria for evaluating, selecting, monitoring and re-evaluating external providers, and to keep records of those activities. A report is one input to that evaluation. The record of the decision is what an auditor will ask to see. For how this works in practice, read about controlling externally provided processes, products and services under ISO 9001 clause 8.4.

A precision engineering firm approving a hosted production scheduling system is a good example. The supplier sends a certificate. The reviewer still needs to confirm the certificate covers that system, that it is current and that the recorded decision explains why it was enough.

What to read in an ISO 27001 certificate

The certificate scope: does it cover the service you are buying?

The scope statement names the activities, services and sites that the supplier's information security management system covers. A certificate for the head office does not cover a data centre or a platform outside that scope. Compare the statement with the product name, the entity that signs your contract and the sites where your data is processed. Read exclusions as carefully as inclusions.

The certification body: accredited, and by whom

The certificate names the certification body that audited the supplier. In the UK, UKAS accredits certification bodies, and the accreditation mark usually appears on the certificate. Check the certification body in the accreditation body's directory, and confirm the certificate number with the certification body. A certificate from a body without accreditation is not backed by that check.

Validity, edition and the Statement of Applicability

A certificate runs on a three-year cycle with surveillance audits in between, so check the issue and expiry dates. Check the edition too. The transition from ISO/IEC 27001:2013 to the 2022 edition closed on 31 October 2025, so a certificate still shown against the 2013 edition should be queried. Ask for the Statement of Applicability, which lists the controls the supplier applies and why it excludes others. It tells you which controls sit behind the certificate.

What to read in a SOC 2 Type II report

SOC 2 is an attestation framework from the AICPA, the American Institute of CPAs. No UK law requires it, and a UK manufacturer decides whether to accept one. A Type II report tests whether controls operated effectively over a period. A Type I report looks at design on a single date, so it gives less assurance.

A report has four main parts: the auditor's report, management's assertion, the system description and the tests of controls with their results. To see the structure, including the auditor's opinion and the system description, look at the AICPA's illustrative SOC 2 Type 2 service auditor's report. It is a nonauthoritative staff publication, so use it to find your way around a real report and not as a standard.

Read five things, in this order. First, the system description: does it describe the service you buy, and which subservice organisations does it name? Check whether their controls are included in the report or carved out. Second, the period covered. Reports commonly cover six to twelve months, so compare the end date with today. Third, the auditor's opinion. An unmodified opinion is the clean result. A qualified or adverse opinion, or a disclaimer, means the auditor found a significant problem.

Fourth, the exceptions in the tests of controls, with management's responses. An exception is a test where the control did not work as described. Judge it by what it touches. An exception in an HR onboarding check matters less to a hosted scheduling system than one in access control. Fifth, the complementary user entity controls. These are controls the supplier expects its customers to run, such as removing leavers' access promptly. The manufacturer must map each to a control of its own.

When a report is enough and when the pattern calls for more

These five patterns cover typical cases a reviewer meets. Each row pairs what arrives with the action to take.

What lands on your desk	What to do with it	What you gain
A certificate whose scope names a different product, entity or site	Ask for a scope statement that covers your service, or treat the certificate as not applicable and use targeted questions	Approval rests on evidence that applies to what you buy
A SOC 2 Type II report whose period ended over a year ago	Request the latest report or a bridge letter from the supplier covering the gap, and diarise the next report	Cover for the months since the period closed
A report with exceptions in access control and no explanation	Read the exception and the management response, check whether it touches your data and ask for remediation evidence	A decision based on the actual exception, not the headline opinion
Complementary user entity controls listed and nobody has checked them	Map each one to a control on your side and name an owner	Gaps on your side found before approval
A routine supplier with a low-impact service and a valid, in-scope certificate	Accept the certificate after a scope check and skip the questionnaire	Faster onboarding for suppliers that do not need a deep review

A report is enough to approve a supplier only when these conditions hold

A report is enough when all of the following are true:

• The scope or system description covers the service, entity and sites you use
• The certificate is valid and issued by an accredited body, or the SOC 2 period is recent
• The SOC 2 opinion is unmodified and any exceptions do not touch your data or service
• Each complementary user entity control has an owner on your side

A report is not enough when any of these apply:

• The scope excludes the service or a subservice organisation that handles your data
• The opinion is qualified or adverse, or exceptions in access or change control are unexplained
• The service carries requirements the report does not test, such as a specific customer clause
• The supplier cannot supply the Statement of Applicability or the full report under confidentiality terms

What to look for in approved supplier list management software for UK manufacturers

Approved supplier list management software should hold each certificate or report against the supplier, with the scope text, the service it covers and the expiry or period end date. It should alert before expiry. It should record the accept or reject decision with the reason, plus fields for exceptions and user entity controls, each with an owner. Reviewers should be able to search by scope and export the record for an ISO 9001 audit of external provider control.

Read the scope, the period and the exceptions before approving

An ISO 27001 certificate or SOC 2 report can replace a questionnaire when it covers the service, is current, shows no unexplained exceptions and leaves the manufacturer's own controls mapped. When it does not, a targeted question closes the gap. In both cases the approval record should say what was read and why it was enough.

Readers who want to continue the discussion can join practitioners in Ideagen's Reddit community.