Learn how to verify ISO 27001 certificates, interpret SOC 2 Type 1 and Type 2 reports, review scope and auditor findings, identify assurance gaps and document supplier risk recommendations. Includes worked examples and a practical evidence review exercise.
You are a GRC analyst working at a financial technology company.
The organisation plans to onboard a new Software-as-a-Service (SaaS) provider that will process customer information and integrate with an important business application.
You have completed the supplier's inherent risk assessment and issued a security due diligence questionnaire.
The supplier responds:
We are ISO 27001 certified and SOC 2 Type 2 compliant. Please find the attached documents.
Does this mean the supplier has adequate security controls?
Can you mark every questionnaire response as satisfactory?
What if the ISO 27001 certificate covers a different service? What if the SOC 2 report identifies exceptions? What if the report relies on controls that your own organisation is expected to implement?
These are the questions a GRC analyst needs to consider.
Independent assurance documents can significantly reduce uncertainty, but they must be interpreted correctly.
This guide explains how to review ISO/IEC 27001 certificates and SOC 2 reports, identify limitations, document findings and determine whether further evidence is necessary.
The aim is not simply to confirm that an assurance document exists. It is to determine what the document actually supports.
Supplier assurance is the process of obtaining and evaluating information about the controls, practices and governance arrangements relevant to a third-party relationship.
Information may come from:
These sources do not provide the same level or type of assurance.
A security policy may show what an organisation intends to do.
A configuration record may show how a particular system is configured at a specific point in time.
An independent assurance report may provide evidence of controls examined by a qualified external practitioner, within a defined scope and reporting period.
Your role is to consider the relevance, quality and limitations of this evidence.
Whenever you receive an assurance document, ask:
These questions form the basis of a defensible evidence review.
ISO/IEC 27001 is an international standard specifying requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS).
An ISMS provides a structured approach to managing information security risks through governance, policies, risk assessment, controls, monitoring and continual improvement.
The relevant current edition for this guide is ISO/IEC 27001:2022.
An organisation may obtain independent certification to the standard through a certification body.
Certification provides assurance that the organisation's ISMS, within the stated certification scope, has been independently assessed against applicable requirements of the standard.
It does not mean:
A certified organisation may still have vulnerabilities, incidents, operational weaknesses or controls that are not relevant to your particular relationship.
ISO does not issue ISO/IEC 27001 certificates itself.
Certification bodies issue certificates.
Accreditation bodies may independently evaluate certification bodies against relevant competence and impartiality requirements.
Accredited certification can provide additional confidence in the certification process.
However, certification and accreditation are separate concepts, and accreditation status should be verified rather than assumed from a logo.
Consider Northbridge Cloud Services, a fictional company proposing to host Meridian Financial Services' production customer platform.
Northbridge provides an ISO/IEC 27001:2022 certificate.
The GRC analyst should perform several checks.
Confirm that the certificate identifies the appropriate legal entity.
A supplier may operate through multiple subsidiaries, regional entities or trading names.
For example, Meridian may be contracting with Northbridge Cloud Services UK Ltd, while the certificate covers Northbridge Corporate Holdings Ltd.
This does not necessarily make the certificate invalid.
However, the analyst must determine whether the entity delivering the service falls within the certified scope.
Check that the certificate identifies ISO/IEC 27001 and the applicable edition.
Do not confuse certification to another management system standard with certification to ISO/IEC 27001.
For example, ISO 9001 relates to quality management and does not establish ISO/IEC 27001 certification.
Review the issue date, expiry date and any other relevant certification information.
An unexpired certificate is not automatically proof of current validity.
Its status may have changed.
Where appropriate, confirm the status directly with the issuing certification body or through a recognised certification verification service.
Identify the certification body.
Where accredited certification is claimed, confirm the relevant accreditation and whether it covers certification to ISO/IEC 27001.
Useful resources include:
If a certificate cannot be located in a registry, investigate before concluding that it is false. Registry coverage and record availability can differ.
This is one of the most important steps.
A certificate may cover:
Corporate IT operations, internal human resources systems and administrative information security management.
However, the supplier is being assessed for production cloud hosting.
The certification may be genuine and current, but the scope does not clearly establish coverage of the purchased hosting service.
The appropriate response is to request clarification and relevant additional evidence.
Determine whether the certificate covers the relevant locations, business activities and organisational boundaries.
Where the certification scope or accompanying documentation identifies limitations, consider how those limitations affect the proposed relationship.
A suitable review note could state:
The ISO/IEC 27001:2022 certificate has been verified as current. However, the stated ISMS scope covers internal corporate operations and does not clearly include the production hosting service proposed for Meridian. The certificate therefore provides limited assurance for this relationship. The supplier should confirm the service's coverage and provide relevant additional evidence.
This is better than either accepting the certificate uncritically or automatically rejecting the supplier.
| Review item | What to confirm |
|---|---|
| Legal entity | Correct supplier entity and relationship |
| Standard | ISO/IEC 27001 and applicable edition |
| Issuer | Identified certification body |
| Accreditation | Status and relevant scope, where claimed |
| Validity | Current certification status |
| Scope | Purchased service and relevant ISMS boundaries |
| Locations | Applicable sites and operational arrangements |
| Exclusions or limitations | Effect on assurance |
| Supporting evidence | Whether further service-specific evidence is needed |
| Review conclusion | Relevance, gaps and next actions |
An ISO/IEC 27001 Statement of Applicability identifies controls considered necessary, their inclusion or exclusion and related justification in the ISMS.
A relevant extract or summary can help establish which controls apply to the proposed service.
However, a full Statement of Applicability may contain information the supplier considers confidential.
Request proportionate information and consider suitable alternatives where appropriate.
The objective is to establish meaningful assurance without unnecessarily exposing sensitive internal security documentation.
SOC 2 is an independent attestation examination concerning controls at a service organisation relevant to the selected Trust Services Criteria.
It is commonly used to provide assurance about technology and service providers.
The Trust Services Criteria cover five categories:
| Category | General focus |
|---|---|
| Security | Protection against unauthorised access and related security events |
| Availability | Availability of systems for operation and use as committed or agreed |
| Processing Integrity | Completeness, validity, accuracy, timeliness and authorisation of system processing |
| Confidentiality | Protection of information designated as confidential |
| Privacy | Personal information practices relevant to the applicable criteria |
The scope of a SOC 2 examination depends on the system and categories selected.
The Security category is common to SOC 2 examinations, but not every SOC 2 report includes all five categories.
A SOC 2 report is not the same as an ISO certification.
It is an attestation report produced by an independent service auditor.
Do not confuse the different SOC reporting arrangements.
SOC 1: Addresses controls relevant to user entities' internal control over financial reporting.
SOC 2: Addresses controls relevant to the applicable Trust Services Criteria for a defined service organisation system.
SOC 3: Provides a more general-use report based on the Trust Services Criteria, with less detailed information available to the reader than a SOC 2 Type 2 report.
For supplier cybersecurity and information-security reviews, SOC 2 is often particularly relevant, but the appropriate assurance depends on the risks being assessed.
An important GRC skill is distinguishing the two report types.
| Feature | SOC 2 Type 1 | SOC 2 Type 2 |
|---|---|---|
| Assessment timing | Specified point in time | Specified period |
| Control design | Examined | Examined |
| Operating effectiveness over time | Not covered by an operating-effectiveness opinion | Examined |
| Auditor testing detail | Does not provide Type 2 operating-effectiveness test results | Provides tests of controls and results |
| Typical use | Evidence about design at a given date | Evidence about design and operation during the period |
A supplier provides a SOC 2 Type 1 report dated 30 June.
The report can provide relevant assurance about the design of controls at that point in time.
It does not establish how effectively those controls operated throughout the previous six months.
Another supplier provides a SOC 2 Type 2 report covering January to June.
That report includes an examination of control operation during the specified period, together with auditor testing information.
A Type 2 report therefore offers additional historical operating-effectiveness assurance.
However, it does not guarantee that controls will continue to work after the reporting period.
A SOC 2 Type 2 report can be lengthy.
The analyst should review its important sections systematically rather than simply searching for the auditor's opinion.
Confirm that the report covers the correct supplier and service.
The report may examine one platform but exclude other services sold by the same organisation.
Identify when the examination took place.
For example:
1 January to 30 June 2026.
If your onboarding review is taking place in October 2026, the reporting period ended several months earlier.
You should consider what may have changed since then.
Determine which categories are included and whether they address the risk areas relevant to your organisation.
A report covering Security and Availability might not provide the same assurance as an examination that also includes the relevant Confidentiality or Processing Integrity criteria.
The absence of a selected category is not automatically a control failure.
It may mean additional information is needed for your assessment.
Establish whether the opinion is unmodified or modified, and understand the stated basis for any modification.
An unmodified opinion is useful assurance within the report's scope.
It should not be translated into a claim that every control is flawless.
A modified opinion requires careful evaluation of the underlying matter and its relevance to your relationship.
The system description explains the service, relevant infrastructure, boundaries, activities and control environment.
Compare it against the service that your organisation intends to purchase.
Check for exclusions and important dependencies.
For a Type 2 report, review the control tests relevant to your supplier risks.
Consider:
Some supplier controls are designed on the assumption that customers will also implement specified controls.
These are commonly called Complementary User Entity Controls (CUECs).
They must not be ignored.
The supplier may rely on another organisation for hosting, infrastructure or processing.
Determine how those dependencies are addressed in the report.
Record the scope, relevant criteria, exceptions, user responsibilities, period gaps and additional evidence required.
Suppose Northbridge provides a SOC 2 Type 2 report.
The auditor tested quarterly privileged-access reviews.
The report states that one sampled review was not completed within the required timeframe.
Does this mean the supplier has inadequate access controls?
Not necessarily.
However, the exception requires evaluation.
Finding: One quarterly privileged-access review was not completed on time.
Potential exposure: Inappropriate access might remain undetected longer than intended.
Assessment status: Further clarification required.
Follow-up: Request the supplier's root cause explanation, remediation status and evidence relevant to preventing recurrence.
An auditor exception is not automatically evidence of a compromise.
Equally, the existence of an overall unmodified opinion does not mean every individual exception can be ignored.
CUECs describe controls that customers are expected to implement for relevant control objectives or criteria to be achieved as assumed.
For example, a SaaS provider may require customers to:
The supplier may have effective controls within its own responsibilities, but the customer's implementation can still affect the overall security of the service.
The report states that customers are responsible for enabling MFA for their administrative accounts.
Meridian has purchased the service but has not enabled that feature.
The analyst should not treat the supplier's report as assurance that Meridian's administrative accounts are adequately protected.
Instead, the analyst should:
CUECs connect supplier assurance with your organisation's internal control environment.
Some suppliers rely on important subcontractors.
For example, a SaaS provider may use a cloud infrastructure service to host its application.
SOC 2 reports may address subservice organisations using different presentation methods.
Under a carve-out method, relevant controls at the subservice organisation are generally excluded from the examination and described accordingly.
Under an inclusive method, certain subservice organisation controls are included within the examination scope.
The analyst should establish which approach applies and what assurance remains necessary.
Northbridge uses an external cloud hosting provider.
The SOC 2 report excludes the cloud provider's controls through the carve-out method.
You should not assume those controls have been tested as part of Northbridge's SOC 2 examination.
Depending on the relationship and risk, you may need additional information about that underlying provider and the controls relevant to your service.
The purpose is to understand material dependencies rather than automatically request separate full audits of every subcontractor.
A SOC 2 Type 2 report covers a historical period.
Suppose a supplier provides a report for 1 January to 31 December 2025.
Your assessment takes place in October 2026.
The report may remain useful, but the gap between the period end and the assessment date is material enough to consider.
Relevant follow-up may include:
A bridge letter may communicate management's representations about the intervening period, but it is not a substitute for an independent SOC 2 Type 2 examination.
There is no single universal number of months after which every SOC 2 report becomes unusable.
The organisation should apply its approved assurance requirements and professional judgement.
Both may be valuable during due diligence, but they provide different types of assurance.
| Area | ISO/IEC 27001 certificate | SOC 2 report |
|---|---|---|
| Nature | ISMS certification | Independent attestation examination |
| Main focus | ISMS conformity within the certified scope | Controls relevant to selected Trust Services Criteria for a defined system |
| Evidence format | Certificate and supporting scope information | Detailed report, particularly for Type 2 |
| Operating-effectiveness detail | Not normally presented in the certificate itself | Type 2 includes operating-effectiveness tests and results |
| Key limitation | May not cover the purchased service or individual control requirements | Limited to report scope, period, examined criteria and relevant responsibilities |
That depends on the assurance question.
A SOC 2 Type 2 report may offer more detailed information about the operating effectiveness of specified controls.
An ISO/IEC 27001 certificate may provide useful assurance about the organisation's scoped ISMS and management approach.
Neither automatically replaces a supplier-specific assessment.
For high-impact relationships, both may be useful, alongside targeted evidence for important controls outside their scope.
Meridian Financial Services proposes onboarding Clearline Support, a fictional SaaS provider processing customer contact and complaint information.
The supplier provides:
Document A: ISO/IEC 27001:2022 certificate
Document B: SOC 2 Type 2 report
ISO 27001: Genuine and current, but its scope does not clearly assure the purchased SaaS platform.
SOC 2 scope: Relevant to the purchased service, making it a useful source of assurance.
Reporting period: Requires consideration of material changes since June 2026.
Access review exception: Requires clarification of significance and remediation.
CUEC: Meridian must establish responsibility for configuring and verifying its own MFA.
Subservice organisation: The excluded infrastructure controls may require further consideration.
| Item | Conclusion | Follow-up |
|---|---|---|
| ISO 27001 status | Verified | Record verification evidence |
| ISO 27001 scope | Limited relevance to the purchased service | Request clarification or service-specific assurance |
| SOC 2 system scope | Relevant | Record scope and criteria |
| Auditor opinion | Unmodified | Review underlying tests and exceptions |
| Privileged-access exception | Potential control concern | Request root cause and remediation evidence |
| Customer MFA CUEC | Internal implementation required | Assign control owner and verify configuration |
| Subservice carve-out | Assurance limitation | Evaluate material fourth-party dependency |
| Reporting period | Historical coverage | Assess intervening changes |
Clearline Support has provided a relevant SOC 2 Type 2 report with an unmodified auditor opinion. However, further review is required concerning a privileged-access review exception, applicable customer-managed MFA responsibilities, and the controls associated with an excluded infrastructure provider. The ISO/IEC 27001 certificate has been verified but does not clearly cover the purchased service. These matters should be addressed through targeted clarification and evidence review before an unconditional assurance recommendation is made.
This recommendation distinguishes useful assurance from unresolved uncertainty.
A supplier assurance register can include:
| Field | Purpose |
|---|---|
| Supplier | Identifies the relationship |
| Service | Defines what is being assessed |
| Document type | ISO certificate, SOC 2 report or other evidence |
| Issuer or auditor | Identifies the assurance source |
| Standard or criteria | States the basis of the assessment |
| Certificate status or report opinion | Records the applicable conclusion |
| Scope | Identifies covered services and systems |
| Validity or reporting period | Establishes the relevant dates |
| Exclusions | Records matters outside assurance coverage |
| Exceptions | Records issues requiring evaluation |
| Customer responsibilities | Records applicable CUECs |
| Reviewer conclusion | States relevance and sufficiency |
| Follow-up actions | Records requests, owners and deadlines |
Do not treat an evidence review register as a replacement for the supplier risk assessment.
The evidence review should inform control conclusions, findings and residual risk assessment.
You are a junior GRC analyst at Meridian Financial Services.
The organisation intends to use DataBridge Analytics, a fictional SaaS provider that will process customer transaction analytics.
The supplier provides the following information.
Prepare a supplier assurance review containing:
Certificate verification: Confirm the issuing certification body, relevant accreditation and current certification status through appropriate authoritative sources.
Certificate scope: The certified scope does not clearly cover the purchased analytics platform, so the certificate alone provides limited service-specific assurance.
SOC 2 relevance: The Type 2 examination covers the purchased platform and provides relevant historical design and operating-effectiveness assurance for the examined criteria.
Exceptions: The missed vulnerability remediation deadline should be reviewed for its significance, recurrence, affected systems and remediation status.
Customer responsibilities: Meridian should verify how it protects and manages customer-controlled API credentials.
Fourth-party exposure: Assess the material hosting dependency and determine whether additional assurance is required.
Reporting gap: Consider material changes since December 2025, supported by suitable updates or current evidence.
Recommendation: Continue targeted due diligence on the unresolved matters before providing an unconditional assurance recommendation. Document the results and refer material outstanding exposure to the designated risk authority.
| Criterion | Marks |
|---|---|
| Verification and scope analysis | 25 |
| SOC 2 interpretation | 25 |
| Exceptions and limitations | 20 |
| Customer and fourth-party responsibilities | 15 |
| Management recommendation | 15 |
| Total | 100 |
This is a guided exercise, not an independently verified assessment.
A genuine certificate may cover a different part of the supplier's business.
SOC 2 is an attestation reporting arrangement, not ISO-style certification.
A Type 1 report does not provide the historical operating-effectiveness assurance included in Type 2.
You also need to examine scope, exceptions, period, dependencies and applicable customer responsibilities.
The customer may need to implement controls that are assumed in the service's control environment.
The report may exclude material controls operated by external service providers.
Independent assurance reduces uncertainty but does not establish that incidents are impossible or that every control is relevant to your needs.
A gap in evidence should be documented and investigated before drawing conclusions about the control itself.
A finding without supporting evidence, ownership and follow-up is difficult to track or defend.
Before completing your review, confirm:
ISO/IEC 27001 certificates and SOC 2 reports can provide valuable information during supplier due diligence.
However, their value depends on understanding what they cover and what they do not.
ISO/IEC 27001 certification relates to an ISMS within a defined scope.
SOC 2 reports provide independent assurance about controls relevant to selected Trust Services Criteria for a specified system.
SOC 2 Type 2 provides historical operating-effectiveness assurance that Type 1 does not.
GRC analysts must examine scope, auditor opinions, exceptions, reporting periods, customer responsibilities and material supplier dependencies.
A certificate or assurance report should inform your judgement, not replace it.
Next lesson: Assessing Supplier Security Controls and Evidence Gaps
You now know how to interpret important independent assurance documents and recognise their limitations.
In the next lesson, you will learn how to evaluate supplier control design and operating effectiveness, distinguish unsupported assertions from confirmed control deficiencies, and record assurance findings that can support residual supplier risk assessments.