SOC 2 for call centers: the AICPA Trust Services Criteria, Type I vs Type II, scope, bridge letters, reading exceptions and SOC 2 vs ISO 27001 vs PCI DSS.
What is a SOC 2 report for a call center?
A SOC 2 report is an independent attestation by a licensed CPA firm under AICPA standards that evaluates a service organization's controls against the Trust Services Criteria for security and, optionally, availability, processing integrity, confidentiality and privacy. For a call center, it tells a buyer whether controls protecting client data are well designed and, in a Type II, operated as described.
SOC stands for System and Organization Controls, a family of reports defined by the American Institute of Certified Public Accountants. A SOC 1 report addresses controls relevant to a client's financial reporting; a SOC 2 report addresses controls over security and related principles; a SOC 3 is a short general-use summary of a SOC 2. The SOC 2 report is the one buyers of outsourced customer contact and back office work ask for, because a call center holds the client's customer data, logs into the client's systems and often has broad access to records. This guide explains what the report contains, why buyers want it, how Type I and Type II differ, how to check scope, what a bridge letter does, how to read exceptions and how SOC 2 compares with ISO/IEC 27001 and PCI DSS. It is a general explanation; the auditor's report and your own security team decide what any specific document proves. The controls a buyer should expect to see tested are listed in the call center data security checklist.
Why do buyers ask call centers for a SOC 2 report?
Buyers ask for a SOC 2 report because it replaces a long security questionnaire and a site visit with evidence gathered by an independent auditor who has already examined the provider's policies, tested its controls and written down what did not work. For a buyer's own compliance team, the report also satisfies third-party risk management expectations from regulators in banking, insurance, healthcare and telecommunications, who require oversight of vendors that handle customer data. Procurement teams in regulated sectors often treat a current SOC 2 Type II as a gate before a provider can be shortlisted, as described at BPO for regulated industries.
For the call center the report is a sales asset and an operating discipline. Preparing for it forces the provider to document access management, change control, incident response, vendor management and monitoring, and the annual testing cycle keeps those controls from decaying. A provider that has been through several report cycles usually has cleaner evidence, fewer exceptions and faster answers to a buyer's questions.
What are the Trust Services Criteria?
The Trust Services Criteria are the AICPA's framework of control objectives against which a SOC 2 auditor evaluates a service organization, organized into five categories of which security is mandatory and the other four are chosen by the organization based on what it promises its clients:
- Security. The system is protected against unauthorized access, use and modification. These are the common criteria, mandatory in every SOC 2, and cover the control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management and risk mitigation.
- Availability. The system is available for operation and use as committed. Relevant to a call center that promises uptime, redundancy and business continuity.
- Processing integrity. System processing is complete, valid, accurate, timely and authorized. Relevant where the provider processes transactions such as orders, payments or claims on the client's behalf.
- Confidentiality. Information designated as confidential is protected as committed. Relevant to client data, scripts, pricing and anything covered by non-disclosure terms.
- Privacy. Personal information is collected, used, retained, disclosed and disposed of in line with the organization's privacy notice and the AICPA's privacy criteria. Relevant where the call center handles consumer personal data under laws such as GDPR, PIPEDA and US state privacy statutes.
The organization chooses which categories to include, and the choice is itself informative. A call center that includes only security has not had its availability or privacy practices tested, which matters if the buyer's own obligations depend on them. The criteria define objectives, not specific controls; the provider designs the controls, and the auditor tests whether they meet the criteria.
What is the difference between a SOC 2 Type I and Type II report?
A Type I report describes the provider's system and evaluates whether its controls are suitably designed to meet the criteria as of a single date, while a Type II report covers a review period, usually six to twelve months, and tests whether the controls operated effectively throughout it. A Type I can be produced quickly by a provider that has just finished building its program; a Type II requires the program to have run long enough to generate evidence. Buyers should want the Type II, because a well-designed control that nobody follows is not a control.
A first Type II often covers a shorter period than later ones, and a provider that is new to the process may offer a Type I with a Type II to follow. That is acceptable for an early conversation but should be written into the contract as a deliverable with a date, so the buyer is not relying on design alone for a year of production.
How do you check the scope of a SOC 2 report?
You check scope by reading the system description, the section the provider's management writes to define the boundaries of what was examined: the services, the locations, the infrastructure, the software, the people and the data covered. A report scoped to a provider's cloud hosting environment at headquarters says nothing about an agent floor in another country or a work-from-home workforce. Confirm that the sites, delivery centers and agent models that would serve your program appear in the description.
Look also at how the provider treats its own vendors, called subservice organizations. Under the carve-out method, the controls of a cloud host, telephony platform or recording vendor are excluded from the report, and the system description lists what those vendors are expected to do; the buyer then needs those vendors' own SOC reports. Under the inclusive method, the vendor's controls are tested within the report. Finally, read the complementary user entity controls, which are the things the report assumes the client will do, such as managing its own users in the shared systems or approving access requests. If your organization does not perform those controls, the provider's clean report does not protect you.
What is a bridge letter?
A bridge letter, also called a gap letter, is a short statement issued by the provider's management, not by the auditor, confirming that no material changes to the control environment have occurred between the end of the last SOC 2 period and the date of the letter. Because SOC 2 reports cover a fixed period and are issued some weeks after it ends, there is always a gap between the report's end date and the present. The bridge letter covers that gap for a buyer whose own audit cycle falls inside it.
A bridge letter carries management's assertion only; it has not been tested by anyone. It is appropriate for a gap of a few months and a provider with a steady history of clean reports. A bridge letter covering a long period, or standing in for a report that is overdue, is a signal that the provider has missed a cycle, and the buyer should ask why and when the next report will be issued.
How do you read exceptions and the auditor's opinion?
Read the auditor's opinion first, then the test results. The opinion will be unqualified, meaning the auditor found the description fair and the controls suitably designed and, for Type II, operating effectively; qualified, meaning the auditor found one or more significant problems but the report is otherwise reliable; adverse, meaning the controls did not meet the criteria; or a disclaimer, meaning the auditor could not form an opinion. A qualified opinion is not automatically disqualifying, but the buyer should understand exactly what was qualified and why.
The tests of controls section lists every control the auditor tested, the test performed and the result. Where a control did not operate as described, the auditor records an exception, and management usually adds a response explaining the cause and the remediation. Exceptions are normal in a report of any size, and a report with no exceptions at all deserves a second look at how thoroughly the testing was done. What matters is the pattern: isolated exceptions in low-risk areas with credible remediation are routine; repeated exceptions in access management, change control or incident response, or the same exception appearing in consecutive years, point to a program that is not working. Compare the exceptions with the controls your program depends on most.
How does SOC 2 compare with ISO 27001 and PCI DSS?
SOC 2, ISO/IEC 27001 and PCI DSS all concern information security but answer different questions, and a mature provider may hold all three:
- SOC 2. An attestation report, issued by a CPA firm under AICPA standards, describing the provider's own controls and whether they met the Trust Services Criteria over a period. Flexible in scope and content, most common in North America, and the most informative to read because it shows the actual controls and test results.
- ISO/IEC 27001. A certification, issued by an accredited certification body, that the provider operates an information security management system meeting the international standard, with a defined scope and a cycle of surveillance audits. More common outside North America. The certificate confirms the management system exists and is audited; it does not show the buyer the control tests.
- PCI DSS. A prescriptive standard from the PCI Security Standards Council that applies only where payment card data is handled, validated by a Report on Compliance or Self-Assessment Questionnaire and summarized in an Attestation of Compliance. Narrow in subject, specific in requirements and mandatory rather than optional for anyone in scope; see PCI compliance for call centers.
A SOC 2 report does not make a provider HIPAA compliant or GDPR compliant, since those are legal regimes rather than control frameworks, but its privacy and confidentiality criteria and tested access controls are strong supporting evidence under both. How HIPAA obligations are evidenced is covered at HIPAA compliance for call centers.
Is "SOC 2 certified" the right term?
No. There is no SOC 2 certification and no body that issues one; a provider receives an attestation report in which an independent auditor expresses an opinion on its controls for a period. The phrase "SOC 2 certified" is common in marketing but is a misnomer, and a buyer who hears it should simply ask for the report. The same scrutiny applies to every provider, including this one: ask for the current report under a non-disclosure agreement, read the opinion, the scope, the subservice organizations, the complementary user entity controls and the exceptions, and ask for a bridge letter if the period has ended.
Procurement teams usually request the report during the formal evaluation stage, alongside the security questionnaire and site visit; the sequence is described in the call center RFP guide and how to choose a BPO partner. If you are evaluating providers for a program where your own auditors or regulators will ask what assurance you obtained, request a proposal and state the attestations, criteria and scope your program requires so the response can address them directly.
SOC 2 for Call Centers: Frequently Asked Questions
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards, in which the auditor gives an opinion on the provider's controls against the Trust Services Criteria. No organization certifies SOC 2. A provider that says it is SOC 2 certified should be asked for the report itself.
Should I ask a call center for a SOC 2 Type I or Type II?
Ask for a Type II. A Type I evaluates whether controls are suitably designed at a point in time; a Type II tests whether they operated effectively over a review period, usually six to twelve months, and lists exceptions. If a provider only has a Type I, write the Type II into the contract as a dated deliverable.
What is a SOC 2 bridge letter?
A bridge letter is a statement from the provider's management, not the auditor, that no material control changes have occurred between the end of the last SOC 2 period and the letter date. It covers the gap between reports and carries management's assertion only, so it should cover a few months at most.
What is the difference between SOC 2 and ISO 27001?
SOC 2 is an attestation report by a CPA firm that describes a provider's controls and whether they met the AICPA Trust Services Criteria over a period. ISO/IEC 27001 is a certification by an accredited body that the provider runs an information security management system meeting the international standard. SOC 2 shows the buyer the control tests; ISO 27001 confirms the system is certified and audited.
Does a SOC 2 report cover all of a call center's locations?
Only the locations, services and systems named in the system description. A report scoped to a headquarters data center does not cover a delivery center in another country or work-from-home agents. Buyers should confirm that the sites and agent models serving their program are inside the described scope.
Sources and References
The laws, standards and certifications this page refers to, linked to their official text or publisher.
- HIPAA (Health Insurance Portability and Accountability Act), U.S. Department of Health & Human Services: privacy and security rules for protected health information.
- PCI DSS (Payment Card Industry Data Security Standard), PCI Security Standards Council: handling of payment card data.
- SOC 2, AICPA & CIMA: independent audit of a service organization's security controls.
- ISO/IEC 27001, International Organization for Standardization: information security management systems.
- PIPEDA (Personal Information Protection and Electronic Documents Act), Office of the Privacy Commissioner of Canada: private-sector privacy law in Canada.
- GDPR, Regulation (EU) 2016/679, EUR-Lex, Publications Office of the European Union: data protection law in the European Union.