1. Direct Access via the Compliance Portal
The fastest way to get the latest report (e.g., SOC 2 Type II) is through Intuit’s dedicated compliance site:
Process: 1. Log in using your Intuit credentials (the same ones you use for QuickBooks). 2. Search for or select the QuickBooks Online Ecosystem report. 3. You will likely be prompted to review and click "I Agree" to a digital NDA. 4. Download the PDF file.
2. Requesting via QuickBooks Online Support
If you cannot find the specific version you need (like a SOC 1 report, which is often limited to specific payroll subscriptions) or the portal is giving you trouble, you can request it through the app:
Step 1: Sign in to your QuickBooks Online account.
Step 2: Click the Help (?) icon in the top right.
Step 3: Type "SOC Report" in the search or assistant chat.
Step 4: Select Contact Us to speak with an agent who can verify your account and provide the document or a direct link.
Important Audit Tips
SOC 1 vs. SOC 2: Accountants usually look for SOC 1 Type II for financial reporting audits (internal controls over financial reporting) and SOC 2 Type II for security and data privacy audits. Note that QBO primarily focuses on providing the SOC 2 report.
Bridge Letters: If the SOC report is "stale" (meaning it covers a period that ended a few months ago), your auditor may ask for a Bridge Letter (or Gap Letter). This is a statement from Intuit confirming that their controls haven't changed significantly since the report was issued. These are also typically found on the Compliance Portal.
Audit Log vs. SOC Report: Don't confuse the SOC Report (which audits Intuit's systems) with the QuickBooks Audit Log (which tracks your users' activity). If your auditor wants to see who changed a specific transaction, go to Settings (Gear Icon) > Audit Log.
Note: If you are using QuickBooks Desktop, the process is different as you are responsible for the security of the local server where the data is stored. Intuit only provides SOC reports for the cloud-based portions of their services.