What Is a SOC 2 Type 2 Report? Crestwood Associates’ Latest Audit Explained

Crestwood Associates, LLC recently completed a SOC 2 Type 2 audit for its Cloud Services practice and internal ERP system. The audit covered the period from July 1, 2025 to September 30, 2025 and was conducted by Baker Tilly US, LLP.

This independent assessment evaluated Crestwood’s controls related to Security, Availability, and Confidentiality. These areas are critical for organizations that rely on cloud-based ERP systems and managed cloud services.

What Is a SOC 2 Type 2 Report?

A common question for organizations evaluating technology partners is: what is a SOC 2 Type 2 report?

A SOC 2 Type 2 report is an independent audit that confirms a service provider has effective controls in place to protect customer data and systems over time. Unlike a SOC 2 Type 1 report, which only evaluates whether controls are designed appropriately at a specific point in time, a Type 2 report examines how those controls operate consistently throughout a defined review period.

SOC 2 Type 2 reports are often requested by customers, auditors, and compliance teams as part of vendor risk assessments. They provide assurance that security and operational controls are not only documented but actively followed in real-world conditions.

Key Findings from Crestwood’s SOC 2 Type 2 Report

1. Clean Audit Opinion

The auditor issued an unqualified, or clean, opinion. This confirms that Crestwood’s system description was accurate, the controls were properly designed, and the controls operated effectively throughout the audit period. No exceptions or negative findings were identified.

2. No Security Incidents or Material Changes

The report states that there were no system incidents or significant service changes during the three-month review period. This level of consistency is important for customers who depend on stable and reliable cloud services.

3. Controls Operated as Intended

The audit tested a wide range of controls aligned to SOC 2 criteria, including user access management, encryption, backup procedures, and incident response processes. All tested controls were found to be operating as intended during the review period.

4. Use of Microsoft Azure as a Subservice Organization

Crestwood’s cloud infrastructure is hosted on Microsoft Azure. As is standard in SOC 2 reports, certain controls are assumed to be handled by the hosting provider. While the auditor did not directly evaluate Azure’s controls, this approach is common and relies on Microsoft’s established compliance posture.

What This Means for Crestwood Customers

For current and prospective customers, Crestwood’s SOC 2 Type 2 report provides clear assurance that security, availability, and confidentiality are managed with discipline and consistency. It demonstrates that Crestwood follows documented controls and applies them in day-to-day operations.

The SOC 2 Type 2 report is available to existing clients upon request. Customers can contact their Customer Success Manager for additional details.

Is Crestwood the Right Fit for Your Organization?

Understanding what a SOC 2 Type 2 report is can help organizations make informed decisions when selecting a cloud services or ERP partner. Crestwood’s successful audit reflects a strong control environment and a commitment to industry best practices.

For organizations that prioritize security, operational reliability, and compliance, Crestwood Associates offers a cloud services approach designed to meet those expectations without unnecessary complexity.