Summarize vendor SOC report risk from control exceptions, report period, subservice providers, bridge letter, and data access