Bottom line up front: before you sign with a 3PL, get the actual SOC 2 report — not the slide, the report — and spend two hours reviewing it against the checklist below. When you're done, you'll know whether this 3PL's security posture is real or just paperwork.
Don't trust the "we are SOC 2 certified" line in the sales deck. Two problems with it. First, SOC 2 isn't a certification. It's an attestation report issued by a licensed CPA firm under the AICPA framework — there is no certificate, no pass/fail stamp. Second, a three-year-old Type I report and a current Type II report are worlds apart in what they prove. Skip the review and you're signing blind.
First, understand Type I vs. Type II
| Type I | Type II | |
|---|---|---|
| Tests | Whether controls are designed correctly | Whether controls operated effectively over time |
| Timeframe | A single point in time | An observation period, typically 3–12 months (commonly 6–12) |
| What it proves | The model home | What living in the house is actually like |
| Good enough pre-signing? | No | This is the one you want |
One sentence to remember: Type I proves the 3PL knows what the right controls look like. Type II proves it actually ran them for the better part of a year. You're about to hand over hundreds of thousands of units and all your order data — you obviously want the second one. I've seen this exact failure three times: a client takes a Type I into their own enterprise customer's vendor security questionnaire and gets bounced on the spot.
The 7-step SOC 2 report review checklist
Go in order. Don't skip steps.
1. Check the audit period. It's on the cover page. If the period ended more than 12 months ago, the report is stale — ask for a management bridge letter (a signed statement that controls haven't materially changed during the gap), or just demand the latest report.
2. Read the system description — the scope. This is the most important section in the entire report, more important than the auditor's opinion. Check which systems are in scope: is the WMS in there? The order management system? Plenty of 3PL reports cover only "corporate IT" while the warehouse systems you actually care about sit outside the audit boundary. The report will never mention a problem in a system it didn't examine.
3. Check which Trust Services Criteria were selected. SOC 2 has five: Security (mandatory in every report), Availability, Processing Integrity, Confidentiality, and Privacy. What matters is what the 3PL selected beyond Security. For a fulfillment provider, Availability should be there (systems can't go down on you), and Confidentiality should be there too (your inventory and order data live in their hands). A report with Security only means they answered just the mandatory question.
4. Read the auditor's opinion. The floor is an unqualified opinion. A qualified or adverse opinion is an instant red flag — you can stop reading there.
5. Count the exceptions. These are the instances where the auditor's testing found a control that didn't operate as designed. Evaluate on three dimensions: how many, whether they cluster on the same control, and whether the same control shows exceptions year after year. One isolated exception with a management remediation plan and timeline is acceptable. The same control failing every year means the remediation exists only on paper.
6. Read the Complementary User Entity Controls (CUECs). Every report has a section listing controls the 3PL assumes you will perform — things like periodic access reviews, encrypting data in transit, deprovisioning terminated users promptly. After signing, all of that is your job. Walk through each one: can you actually do it? If not, either negotiate it into the contract as the 3PL's responsibility now, or pick a different provider.
7. Check subservice organizations. Whose cloud does the 3PL run on? Did the auditor include the cloud provider in scope (inclusive method), or carve it out with a note that "they have their own SOC 2" (carve-out method)? Carve-out is fine, but then go get that cloud provider's report yourself. Don't leave a gap in the chain.
Red flags: see one, pause the signing
- Report hasn't been refreshed in 18+ months, and no bridge letter is available
- Type I presented as if it were enough
- WMS or order systems outside the audit scope
- Same control throwing exceptions two years running, remediation perpetually "planned"
- CUECs listing things you cannot realistically do
- Report issued by someone other than a licensed CPA firm (only a licensed CPA firm can issue a SOC 2 report — a consultancy's self-assessment doesn't count)
Two real-world failures
In 2024, a DTC beauty client of mine signed with a 3PL whose sales deck said "SOC 2 audited." After signing, before go-live, I had them request the actual report. It was a Type I — with an audit period from three years earlier. Their own enterprise customer blocked them in the vendor questionnaire, and they spent three months getting through a Type II observation period. The whole project slipped. I've watched this exact script play out three times.
Another 3PL's report showed four exceptions under Availability, all reading "backup restore testing not performed as scheduled." We didn't kill the deal. Instead we wrote two clauses into the contract: quarterly disaster-recovery drill evidence, with SLA penalties triggered by a missed drill. A report is paper; a contract has teeth. That 3PL hasn't missed a drill since.
The counterintuitive part: a "clean" report doesn't mean secure
Most people review a SOC 2 report by checking whether the opinion is unqualified. That's backwards. The opinion only covers what's inside the stated scope. A narrowly scoped report will obviously come back clean — a report that only examined corporate email can't uncover WMS problems.
So the correct order is: scope first, then criteria, then exceptions, and the opinion last. Reverse that order and you're reading the conclusion before the exam paper.
Here's the go-live-eve checklist, compressed: Type II + fresh period + WMS in scope + Availability and Confidentiality selected + unqualified opinion + acceptable exceptions + CUECs you can actually perform. All seven green, sign. One red, negotiate terms. Two or more red, walk away.
One last note on why those two hours are worth it: IBM's 2025 Cost of a Data Breach report puts the global average breach cost at $4.44 million. Your inventory data, your order data, your customer data — all of it sits with your 3PL. Two hours for that peace of mind is a cheap trade.
By Lin Xiao, WMS Implementation Consultant
