Reads your control matrix and evidence, tests operating effectiveness across the review period with samples and exceptions, and drafts a fully-formatted AICPA SOC 2 Type II report, opinion, system description, and the Section 4 testing table, as a .docx for your auditor to review.
Interactive demo drafting a Type II report end to end, no signup
01
Capture the engagement, the company, the review period with duration presets, the service-auditor firm and the Trust Services Criteria in scope, with Security always included.
02
Validate the uploaded control matrix and organise the supporting evidence into per-criteria folders before any drafting begins.
03
Test each control's operating effectiveness by drawing samples distributed across the whole period, applying a severity gate so only genuine deviations become exceptions.
04
Draft Sections 1 through 4 in the AICPA structure, derive the opinion from the testing, and render a formatted .docx and .pdf for auditor review.
What You Can Do
Drafts the actual AICPA SOC 2 Type II report, the auditor's report, management assertion, system description and tests of controls, over a review period, distinct from a point-in-time gap assessment.
See it in the demoType II is about operating effectiveness across time. The period is captured with one, three, six and twelve-month presets, and every test draws samples distributed across it.
See it in the demoSecurity (CC1–CC9) is always in scope; Availability, Confidentiality, Processing Integrity and Privacy are added as the engagement requires, with the criteria codes carried through to every control.
See it in the demoA Section 4 exception is reserved for genuine high or critical operating failures; low and medium gaps are recorded as readiness observations only, so the opinion is qualified by real deviations, not by maturity nitpicks.
See it in the demoUnqualified, Qualified, Adverse or Disclaimer, the opinion follows from the testing. Zero exceptions is unqualified; one genuine exception qualifies it, and the report says exactly why.
See it in the demoThe five-column testing table carries each control's activity and the procedure in the fixed inquiry-inspection-sampling-re-performance anatomy, with real sample sizes and the exception text.
See it in the demoTwenty-five access grants, twenty-five terminations, twenty-five changes, three months of governance, samples are drawn across the whole review period rather than a single point in time.
See it in the demoControls delegated to a subservice cloud provider, physical access, for instance, are carved out and addressed by complementary subservice organisation controls, marked not-tested rather than failed.
See it in the demoThe output renders to a fully-formatted .docx and .pdf, with an evidence-to-strengthen view separating what is required to issue from what merely helps, and the standing notice that a qualified auditor must review before issue.
See it in the demoBusiness Outcomes
Drafted
Sections 1 through 4 arrive written from your evidence, so the auditor reviews and refines rather than composing from a blank page.
Disciplined
The severity gate and derived opinion keep the report honest, real exceptions qualify it, readiness gaps do not.
Deliverable
The output is a formatted .docx a firm can review and issue, not a spreadsheet someone still has to turn into a report.
Test operating effectiveness across the period and draft Sections 1–4 as a .docx for your auditor to review and issue.