Reading a SOC 2 Type II report
Navigate a realistic Type II report — opinion, system description, control matrices — and know where the risk hides.
Performance-based credential
SOC 2 Report Review Analyst
Proof you can do the work — not just name the framework. Earned by reviewing realistic SOC 2 reports and defending what you find.
What it certifies
Five skills a reviewer uses on day one
Scope and carve-out analysis
Spot carve-outs, subservice organizations, and exclusions that change what the report actually covers.
Mapping controls to trust services criteria
Connect each control to the right Trust Services Criteria and catch mismappings that weaken an assessment.
Judging exceptions and materiality
Decide which exceptions are material, which are noise, and what each means for relying on the report.
Defending findings in writing
Write findings you can stand behind — with the evidence, the criterion, and the business risk connected.
How it's earned
Pass the work. That's the whole exam.
- 01
Pass 3 SOC 2 scenarios
Score 70% or higher on three non-demo report-review scenarios across different industries. The free Meridian Health demo doesn't count.
- 02
Retake freely
Unlimited retakes with coaching after each attempt. Your best score on each scenario is the one that counts.
- 03
Credential awarded
The credential is granted automatically by the platform when your third scenario passes — no application, no waiting.
Why it's different
Not another knowledge cert
Performance-based, not knowledge-based
No multiple-choice exam. You do the work an analyst does — reviewing an actual report — and your output is scored.
Evidence attached
The credential carries your scored work product: what you caught, what you missed, and how you reasoned. A hiring manager sees the work, not just a badge.
Unlimited retakes, best score counts
Mastery matters more than a first attempt. Practice, get coaching, and try again until your work holds up.
Sample work product
What a hiring manager sees
An anonymized, scored submission from a passing scenario. Names and company details are fictional. Every earned credential gets a public verification page; full work-product exports are rolling out.
Scored submission / anonymizedScenario: Harbor Ledger
SOC 2 report review
Candidate #1042 · Financial services scenario · Attempt 2
88%
Passed
Scope analysis
Identified the payroll subservice carve-out and flagged the missing complementary controls.
Control → TSC mapping
Correctly mapped 9 of 10 controls; one availability control mapped to confidentiality.
Exception judgment
Rated the retained-access exception as material and connected it to the opinion language.
Finding defense
Finding was evidence-backed; remediation recommendation needed a clearer risk link.
SOC 2 Report Review Analyst
3 scenarios passed · Best scores: 88% / 91% / 86%
Public verification link · Add to LinkedIn