Each type of SOC report will include the relevant exceptions noted during testing. This is arguably the most important element of a SOC report. You must decide which of your vendor's controls are critical to your organization and evaluate if there are any exceptions noted in those critical areas