Review of third party SOCs is technically a part of the SSAE18 process for financial institutions.
It's mainly important for cases where the third party is in possession of NPI – like AWS for example.
If you have data with Company X, and they use AWS as their IaaS, then it makes sense to check out the SOC report for AWS and make sure their security is up to your standard. Otherwise, it's like only looking at the lock on your locker in a warehouse without looking at the security of the warehouse itself.
Chief Information Officer