What Is SOC 2 Section 5?

SOC 2 Section 5 usually refers to the optional part of a SOC 2 report containing additional information supplied by the service organisation. It is commonly labelled “Other Information Provided by the Service Organization” and sits outside the scope of the service auditor’s opinion.

This distinction matters when a company explains how it has addressed a control exception. Management may describe corrective actions in Section 5, but that explanation does not erase the auditor’s finding or automatically establish that the revised control operates effectively.

For technology companies preparing a report, Section 5 can provide useful context. For customers reviewing a supplier, it requires a different level of reliance from the auditor’s tested findings.

The key points to understand are:

1. Section 5 generally contains supplementary information from management.
2. It is optional, and report numbering can vary.
3. Its contents are not covered by the auditor’s opinion.
4. Remediation statements should distinguish completed actions from future plans.
5. Readers should compare the explanation with the report’s scope, findings and dates.

At PrivaLex, we help organisations connect those explanations to corrective actions and evidence, rather than treating Section 5 as a way to improve the presentation of unresolved issues.

What Does SOC 2 Section 5 Mean?

Section 5 gives management space to communicate information that is outside the subject matter covered by the examination. This may include responses to testing exceptions, planned improvements or information about services outside the assessed scope.

The defining feature is not the section number. It is the statement identifying the information as outside the auditor’s opinion.

The AICPA’s illustrative reporting wording distinguishes supplementary management information from the examined system description and explains that no opinion is expressed on that additional information.

Organisations should therefore avoid describing Section 5 statements as independently verified conclusions unless a separate assessment supports that claim.

Where Section 5 Fits Within a SOC 2 Report

A common SOC 2 Type 2 report structure looks like this:

Section	Typical contents	What readers should understand
Section 1	Independent service auditor’s report	Explains the scope, responsibilities and auditor’s opinion.
Section 2	Management’s assertion	States management’s responsibility and assertion about the assessed system and controls.
Section 3	Description of the system	Defines the services, boundaries and relevant control environment.
Section 4	Controls, auditor’s tests and results	Shows the testing performed and any reported deviations.
Section 5	Other information supplied by management	Provides supplementary context outside the auditor’s opinion.

This is a common presentation, not a compulsory numbering scheme. The AICPA’s illustrative SOC 2 report resource recognises that required information can be organised in different formats.

Readers should check headings and scope statements rather than assuming that every report follows identical numbering.

Companies managing several assurance requirements should also distinguish a SOC 2 report from an ISO certification. The differences between ISO 27001 and SOC 2 affect the assessment, deliverable and way supporting information should be interpreted.

What Can Be Included in SOC 2 Section 5?

The content should be relevant to report users, clearly attributed and consistent with the rest of the report. The following are common examples, subject to discussion with the service auditor.

Management responses to control exceptions

Management may explain the circumstances behind a deviation, the affected process and the corrective action taken or planned.

A useful response distinguishes the original issue from the organisation’s subsequent actions. It should not suggest that an exception was insignificant merely because management has now addressed it.

Remediation progress

Management may describe improvements implemented after an issue was identified.

Dates matter. A control introduced after the examination period should not be presented as though it operated throughout that period. Likewise, completing a configuration change is different from demonstrating that a recurring process now works consistently.

Planned changes and additional services

The organisation may provide context about future system changes or services outside the assessed scope.

That information does not bring those services into the examination. Readers still need to identify which systems and activities the auditor actually assessed.

Other relevant developments

Some developments outside the examined period or scope may help readers understand the organisation’s current position.

However, Section 5 is not a place to relocate disclosures that belong in the examined system description or affect the auditor’s report. Significant changes and subsequent events should be discussed with the auditor so their appropriate treatment can be determined.

Preparing Clear SOC 2 Management Responses with PrivaLex

The difficult part of Section 5 is rarely writing the paragraph. It is confirming that the explanation accurately reflects the finding, the corrective work and the evidence available.

At PrivaLex, we help technology companies, digital platforms and other data-driven organisations prepare management responses that remain consistent with their operating processes and wider compliance programme.

We begin by reviewing the relevant finding, control objective, affected systems and examination period. We work with the responsible teams to establish what happened, why it happened and whether the issue was isolated or indicates a broader process weakness. This gives management a factual basis for its response.

From there, we help structure the corrective-action record. Each action should have an owner, a target date, an implementation status and a clear method for checking effectiveness. Where work remains incomplete, we help distinguish planned measures from changes already deployed.

Our support also includes organising the records behind the response: access-review approvals, configuration changes, training completion, supplier assessments or other evidence relevant to the issue. The aim is to ensure that customer follow-up questions can be answered without reconstructing the remediation history from scattered messages.

Where a finding involves staff responsibilities, the corrective action may require more than a revised procedure. We help connect the change to a role-based training programme, so the people operating the control understand the new process and its evidence requirements.

PrivaLex can also help align customer communications with the report. Security questionnaires, trust-centre statements and sales responses should distinguish the examined position from later management-reported improvements.

Our role is advisory and implementation-focused. The independent CPA firm remains responsible for the SOC 2 examination, report presentation and audit opinion. We help management prepare accurate information and supporting records; we do not turn supplementary statements into audited assurance.

6 Steps to Prepare a Credible SOC 2 Section 5 Response

These steps provide a practical structure for preparing supplementary management information. They are drafting recommendations, not a mandatory AICPA template.

1. Identify the finding precisely

Reference the relevant control or exception so the reader can connect the response to the auditor’s testing results.

Describe the affected process and period without changing the meaning of the finding. Avoid general statements such as “minor administrative issue” when they do not explain what failed or why the control mattered.

2. Establish the cause and assess the exposure

Determine whether the problem arose from unclear ownership, incomplete coverage, a technical failure, missing evidence or another cause.

The assessment should consider which systems or people were affected and whether similar weaknesses could exist elsewhere. A consistent risk assessment process helps management prioritise corrective work instead of relying on unsupported statements that an issue created “no risk.”

3. Describe the corrective action

Explain what changed in practical terms. This might include revising an approval workflow, configuring an alert, reconciling an account inventory or introducing a review step.

Keep the response connected to the original issue. The discipline used when documenting security controls is useful here: describe the process, identify its owner and retain records showing that it was performed.

4. Distinguish implementation from verification

A completed task does not necessarily demonstrate an effective control.

For example, assigning overdue training is different from confirming completion and improving the process for future joiners. Records needed to demonstrate staff training during an audit illustrate that distinction between delivering an action and proving its outcome.

State whether verification is complete, ongoing or scheduled.

5. Use dates and status labels carefully

Separate actions completed during the examination period, changes implemented afterwards and work still planned.

Include relevant dates and avoid vague terms such as “recently resolved.” If a measure is still being tested, describe that status accurately rather than presenting it as fully effective.

6. Review the wording with management and the auditor

The control owner should validate the operational details, and management should approve the explanation.

Discuss the proposed wording with the service auditor, including its placement and consistency with the report. Other information is subject to consistency-related responsibilities under the AICPA’s attestation standards; being outside the opinion does not mean misleading statements can be included without scrutiny.

Example of a SOC 2 Section 5 Management Response

Suppose the auditor identifies that two sampled user-access removals exceeded the organisation’s documented deadline.

A weak response would be:

The issue has been resolved, and our access controls are now fully compliant.

This gives the reader no useful information about the cause, timing or basis for the conclusion.

A more informative, hypothetical response would be:

Management identified that two access-removal requests were not routed promptly because responsibility between HR and IT was unclear. On 15 July, management introduced a shared offboarding workflow with a named IT owner and escalation for overdue requests. The affected accounts were disabled, and the active-user inventory was reconciled against HR records. A follow-up review of subsequent departures is scheduled for 30 September to assess whether the revised workflow operates consistently. These actions occurred after the examination period and have not been assessed under this SOC 2 examination.

The stronger response explains the issue, corrective action and remaining verification. It does not claim that the auditor confirmed the new process or that later remediation changed the original testing result.

How Customers Should Review a Supplier’s Section 5

Customers should read Section 5 alongside the auditor’s opinion, system description and testing results.

For each relevant management statement, ask:

• Which finding or limitation does this address?
• Does it concern the service we will actually use?
• Was the action completed during or after the examined period?
• What records support the statement?
• Has effectiveness been checked, or is verification still planned?
• What residual risk remains for our organisation?

A response should feed into the customer’s supplier-risk decision, not replace it. A structured risk management framework helps connect findings to follow-up actions, acceptance decisions and review dates.

Neither a reported exception nor a reassuring response should determine the decision in isolation. Consider the affected control, business dependency and consequences of failure.

4 Common Mistakes When Using SOC 2 Section 5

1. Treating remediation as a retrospective correction

Later improvements do not change what operated during the original examination period.

Keep the historical finding visible and explain subsequent action separately. Readers need both pieces of information to understand the current position.

2. Using broad claims without supporting records

Statements such as “all risks have been eliminated” are difficult to substantiate and may create unnecessary customer expectations.

Describe the specific action, coverage, verification and remaining uncertainty instead.

3. Moving required information outside the examination

Section 5 should not be used to avoid appropriate disclosure or examination of relevant systems, incidents or control changes.

Discuss the treatment of those matters with the auditor rather than deciding that supplementary placement is sufficient.

4. Assuming SOC 2 establishes every form of compliance

A SOC 2 report does not automatically establish compliance with GDPR or other legal regimes.

For example, a GDPR audit examines accountability matters such as processing records, legal bases, transparency and processor arrangements. Those questions require their own assessment, even when some security evidence overlaps.

Conclusion

SOC 2 Section 5 is best understood as supplementary management context, not an extension of the auditor’s opinion.

Used carefully, it helps readers understand corrective actions and developments outside the examined scope or period. Its credibility depends on accurate wording, clear dates and evidence behind the explanation.

For organisations preparing a report, the priority is to address the underlying issue and explain the outcome honestly. For customers, it is to distinguish management’s statements from independent assurance.

Book a strategic session with PrivaLex or request a free risk assessment to review your control gaps, corrective-action records and preparation priorities.

Frequently Asked Questions (FAQs)