A vendor hands you a SOC 2 Type 2 report. Somebody on the diligence call says “clean report, no exceptions,” everyone nods, and the question moves on.
That is usually where the real review should start. A SOC 2 Type 2 report is genuinely useful evidence, but only for the specific systems, controls, and time period the auditor actually examined. Plenty of reports arrive covering less than the reader assumes.
The stakes went up in the last two years. The SEC’s amended Regulation S-P requires covered firms to maintain written policies requiring oversight of service providers “through due diligence and monitoring.” Compliance dates already passed: December 2025 for larger entities, June 2026 for smaller ones.
Vendor review stopped being a best practice and became a documented obligation.
This piece covers what the report proves, what “zero exceptions” does and does not mean, and the six things worth checking before you accept one.
What Is a SOC 2 Audit?
A SOC 2 audit is an independent CPA examination of a service organization’s controls, measured against the AICPA Trust Services Criteria. Those criteria cover security, availability, processing integrity, confidentiality, and privacy, though not every engagement includes all five. Which ones apply depends on the scope the vendor chose.
The finished report contains the auditor’s opinion, the vendor’s description of its own system, the controls tested, the tests performed, and any deviations found. It is an attestation report, not a certificate, which is why “SOC 2 certified” is technically the wrong phrase even though everyone uses it.
The distinction that matters most to a reader is Type 1 versus Type 2:
A Type 1 report looks at whether controls were suitably designed as of one specific date. It is a snapshot. It tells you the vendor had the right controls written down and in place the day the auditor looked.
A Type 2 report tests whether those controls actually operated over a defined stretch of time, usually six to twelve months. The auditor samples real activity: access reviews, change records, incident documentation, backup tests. This is the one worth asking for, because a control that exists on paper and a control that runs reliably for a year are different things.
An exception is a deviation the auditor found while testing. “Zero exceptions” means the tests turned up no deviations in the samples examined. It does not mean nothing ever went wrong, that every relevant control was in scope, or that the vendor carries no risk. It is a clean testing result within stated boundaries.
Does a SOC 2 Type 2 Report Cover Your Whole Vendor Review?
No, and treating it that way is the common mistake.
The report can answer the control-evidence portion of a vendor review when it covers the services, systems, and period relevant to your relationship. It says nothing about the vendor’s financial condition, contractual terms, business continuity beyond what was scoped, or the operational risks specific to how you use them.
What a current, clean report does buy you is time. You are not recreating evidence an independent CPA already tested, which frees the review to focus on gaps, dependencies, and the risks the report leaves untouched.
Case Study: Nu-Age’s Zero-Exceptions Examination
The setup
The Nu-Age Group has spent nearly three decades as a managed service provider for the CLO and hedge fund sector. It runs IT strategy, cybersecurity, cloud hosting, and 24/7 support out of Secaucus, New Jersey.
That role puts its own controls inside the vendor-review perimeter. When an institutional investor examines the technology behind a fund’s operations, Nu-Age is one of the vendors being examined.
The firm had already built its security framework around what it calls ODD-ready cybersecurity, with immutable, automated logging meant to produce a clean audit trail for SEC and NYDFS compliance. The examination tested whether those controls held up over a full year rather than on a chosen date.
The examination
Derick Diaz, then Director of InfoSec and Engineering, led the work. He holds a Master of Science in Cybersecurity Operations and Analytics along with the CISSP designation.
“A ‘Zero Exceptions’ standard isn’t just a goal; it’s our baseline,” Diaz said. “We bridge the gap between elite security and human-centric leadership to architect the future of Nu-Age.”
Nu-Age’s architecture is security-first by design, from an air-gapped Managed AI platform that lets clients use AI without exposing sensitive data, through a development approach that builds security into source code rather than adding it later. The company framed the audit as a test of ordinary operating discipline instead of an annual documentation scramble.
The result
In April 2026, Nu-Age announced it had completed its SOC 2 Type 2 examination with zero exceptions, covering January through December 2025. The firm remains currently certified.
“The Hedge Fund industry is facing unprecedented cyber threats and regulatory oversight,” said Anthony Chillino, President of The Nu-Age Group. “By investing in these rigorous independent audits, we ensure our clients remain ahead of the curve, maintaining their reputation for excellence alongside our own.”
Chillino called the clean report “a testament to our relentless pursuit of perfection.” Nine days later, the firm promoted Diaz to Vice President of Technology, citing his leadership of the audit.
The precise conclusion a reviewer should draw: no deviations were identified in the auditor’s tests during that period, read against the report’s scope, sampling, and treatment of subservice organizations.
What Zero Exceptions Changes in Practice
A clean result removes one whole category of follow-up. Nobody has to ask why a sampled control failed, what was done about it, and whether the fix reached your environment. Questions about scope, currency, and dependencies remain.
Nu-Age publishes a related example on its hedge fund cybersecurity page: a credit manager facing heavy investor questions about cybersecurity, vendor management, and DDQ readiness. Once the security documentation was organized and the posture strengthened, the manager answered allocators with evidence rather than assurances. Nu-Age reports DDQ turnaround compressing from weeks to days.
Nu-Age backs its private cloud with a 99.999% uptime commitment and maintains a compliance posture built to exceed SEC and HIPAA mandates. Those are the company’s claims. Worth noting that a SOC 2 report does not certify SEC or HIPAA compliance, whatever a vendor’s marketing suggests.
Six Things to Check Before You Accept the Report
Use the report as structured evidence, not a pass/fail badge.
- Period and currency. Does the observation window cover a meaningful, recent stretch? A report covering a period that ended eighteen months ago tells you about a company that may no longer exist in the same form.
- The auditor’s opinion. Unqualified, qualified, adverse, or disclaimed. This is the single most skipped line in the document.
- Scope. Which services, systems, locations, and Trust Services Criteria were included? A report can be spotless and still exclude the product you are buying.
- Tests and exceptions. What did the auditor actually test, using what samples, and what turned up?
- User responsibilities. Complementary user-entity controls are the ones you have to operate for the vendor’s controls to work. The AICPA framework requires the vendor to list them in the system description, and they are there because the vendor’s controls do not function without them. Ignoring them is how a clean report still produces a breach.
- Subservice organizations. Which third parties support the service, and are they inside the examination or carved out of it? Under the carve-out method, the standard approach, the report names the subservice organization and describes what it does, but the auditor never tests its controls and the opinion explicitly excludes them. If your vendor’s data center is carved out, a spotless report tells you nothing about the data center. You need that provider’s own report.
Then connect what you found to the vendor’s actual role, data access, and how badly things break if they go down.
Key Takeaways
- A SOC 2 Type 2 report provides independent control evidence for part of a vendor review, not the whole thing.
- Type 2 tests whether controls operated over a period. Type 1 only checks design on a single date.
- Nu-Age reported zero exceptions for its January through December 2025 examination.
- Scope, dates, opinion, user controls, and subservice organizations still need to be read every time.
Frequently Asked Questions
What is a SOC 2 audit?
An independent CPA examination of a service organization’s controls against the AICPA Trust Services Criteria. A Type 2 examination assesses control design and tests operating effectiveness over a defined period, documenting the auditor’s opinion, the tests performed, and any exceptions found.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 evaluates whether controls were suitably designed at a specific date. Type 2 also tests whether they operated effectively across an observation period, typically six to twelve months. Type 2 is the stronger evidence when you need proof of sustained performance.
What does “zero exceptions” mean in a SOC 2 Type 2 audit?
The auditor’s tests found no deviations from documented controls in the samples examined during the review period. It is a clean testing result, not proof of zero risk, and should be read alongside the report’s scope, dates, user controls, and subservice organizations.
Who needs a SOC 2 report?
Service organizations typically obtain one when customers, investors, or counterparties require independent control evidence. Funds and asset managers commonly request current reports from technology vendors that handle sensitive data or support critical operations.
Is a SOC 2 report the same as being SEC or HIPAA compliant?
No. A SOC 2 report attests to controls against the AICPA Trust Services Criteria. It does not certify compliance with SEC rules, HIPAA, or any other regulation, though the underlying controls often overlap with what those regimes expect.
Source note: Nu-Age details come from the company’s April 2026 SOC 2 announcement, its Diaz appointment announcement, and the linked hedge fund cybersecurity case study. Company claims are attributed to Nu-Age; general SOC 2 explanations draw on AICPA materials.
If your next vendor review includes critical technology providers, look at the evidence behind their controls. Visit The Nu-Age Group at https://www.thenuagegroup.us to discuss its zero-exceptions SOC 2 Type 2 examination, call (866) 640-3999, or email sales@thenuagegroup.us.
