> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vendexlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Evidence review

> Turn a vendor's SOC 2 report into a cited, checked answer for every item on your template.

Reading a 100-page SOC 2 report against your checklist takes hours. **Evidence review** does the first pass for you: Claude reads the whole report, answers every item on your [template](https://docs.vendexlabs.com/guides/templates.md), and cites the page each answer comes from. VendexLabs then checks that every quoted passage really appears in the report. You go through the answers, accept the right ones, and flag the rest.

![Evidence review tab on a vendor, ready for a SOC 2 or audit report upload, with the three steps: read and extract, answer the checklist, review and accept](https://mintcdn.com/vendex-labs/TaraXYWE2PbpKXO9/images/evidence-review.png?fit=max\&auto=format\&n=TaraXYWE2PbpKXO9\&q=85\&s=487e8889ff59688e49d3eaf6a3047870)

> [!NOTE]
>
> Evidence review is part of the **Enterprise** plan. See [Plans & billing](https://docs.vendexlabs.com/account/plans-and-billing.md).

## How it works

**1. Read & extract**

Claude reads the whole report and pulls out the key facts: the auditor, the audit period, the scope, and any exceptions the auditor noted.

**2. Answer the checklist**

Every item on your template gets a **verdict**, a **confidence** level, and a **quote**. VendexLabs looks for each quote in the PDF itself and marks it as verified only when it finds a match on the cited page.

**3. You review & accept**

Filter to the answers that need you, jump to the cited page, and accept or flag each one in a single click.

## Run a review

**1. Upload the report**

Open the vendor's assessment and upload the SOC 2 report (or another security report) under **Evidence & Documentation**. Text PDFs work best. Scanned images can't be read.

**2. Open the Evidence review tab**

On the vendor page, open the **Evidence review** tab and pick the document.

**3. Choose a template and analyze**

Pick the template to check the report against. Your organization's active template is selected by default. Then choose **Analyze report**. The analysis runs in the background, usually in a few minutes, so you can leave the page.

**4. Work through the answers**

The answer list opens on **Needs you**: answers with a low confidence, a gap, or an exception. Select an answer to open the report at the cited page with the quote highlighted. **Accept** the answers that are right and **flag** the ones to follow up on.

## Verdicts

| Verdict | Meaning |
| - | - |
| **Yes** | The report shows the control in place. |
| **Review** | The report mentions it, but the answer is ambiguous. Read the cited passage. |
| **Gap** | The report doesn't address this item. |
| **Exception** | The auditor noted an exception for this control. |

Use the verdict chips above the list to filter by verdict, or switch between **Needs you** and **All**.

## Report checks (red flags)

Alongside the answers, the review runs a set of report-level checks:

| Check | What it looks for |
| - | - |
| **Type II report** | The report tests how controls operated over a period, not just their design. |
| **Current period** | The audit period ended within the last 12 months. |
| **Bridge letter** | If the period ended a while ago, a bridge letter covers the gap. |
| **Security in scope** | The Security (Common Criteria) category is in scope. |
| **No exceptions** | The auditor noted no exceptions. |
| **Subservice organizations** | Carved-out subservice providers are disclosed (for information). |

These checks are worked out by fixed rules from the extracted facts, not by the model, so the same report always produces the same flags.

## Where the results go

Accepted answers become part of the assessment's evidence. They are the strongest source the [AI comment drafts](https://docs.vendexlabs.com/guides/draft-comments-with-ai.md) can cite: a verified quote with a page number. Flagged answers show up under **Needs you** until someone resolves them.

> [!WARNING]
>
> Evidence review is a first pass, not an audit opinion. Read the cited passages for anything that drives your decision.

> [card] [Templates](https://docs.vendexlabs.com/guides/templates.md)
>
> Build the question set a report is checked against.

> [card] [Draft comments with AI](https://docs.vendexlabs.com/guides/draft-comments-with-ai.md)
>
> Turn reviewed evidence into cited assessment comments.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.