I think one of the reasons why you are getting poor responses is that your question is not very focused. You might get the same type of responses here.
This is what you have said:
- Prospective vendor has non-standard report
- You are not sure if you are being overly critical of the vendor
- How do you communicate caution without making accusations?
The question is simply not a security question, but appropriate for Workplace.SE.
What you seem to want to ask is:
- is the non-standard report format valid for SOC 2?
- is there a potential security issue?
You know the answer to #1 and we would only point you to the official documentation. There is no way we can answer #2.
So, given these interpretations, your question would not survive if migrated.
But that is not to say that there could be a form of the question that would work. I'm just not clear on what you really want to ask.