SOC 2 compliance checklist: prepare for your audit

SOC 2 is an examination of a service organization’s system and controls. The applicable criteria and your actual commitments shape the work: there is no single universal list of controls that guarantees a successful report. The AICPA trust services criteria cover security, availability, processing integrity, confidentiality and privacy.

1. Define the scope and report

• Identify the service, customers, locations, systems, people, data and supporting providers relevant to the examination.
• Document system boundaries, data flows, commitments and service dependencies. Identify responsibilities shared with customers and service providers.
• Discuss the applicable trust services categories and the report’s intended audience with your auditor.
• Determine whether customers need a Type I report, a Type II report or both, and agree the date or period. See our Type I vs. Type II guide.

2. Map responsibilities and controls

• Compare existing practices with the applicable criteria and document the gaps.
• Describe each control in plain language: what happens, who performs it, how often, which systems are involved and how exceptions are handled.
• Assign an owner and a backup. Record related policies, procedures, risks, evidence sources and review cadence.
• Prioritize remediation by risk and dependencies, and track an owner and target date for each gap.

The AICPA description criteria provide a basis for preparing and evaluating the system description. Work with your auditor to determine what belongs in your organization’s description.

3. Implement and operate safeguards

The following are common areas to assess. The specific controls, frequency and proof depend on your system and commitments.

• Access: approve access, use appropriate authentication, review privileges and remove access when no longer needed.
• Change management: authorize changes, review and test them, and maintain a record from request through deployment.
• Risk and governance: perform risk assessments, assign treatment, maintain relevant policies and review them periodically.
• People and vendors: provide security training, assess relevant vendors and monitor the responsibilities they perform.
• Operations: monitor systems, manage vulnerabilities, respond to incidents and test recovery arrangements where applicable.

Controls must be performed as described. A policy written just before an audit does not by itself demonstrate that a recurring control operated during a Type II period.

4. Gather and review evidence

• Maintain an inventory connecting each control to its owner, source, collection cadence and retention location.
• Retain dated configuration snapshots and operational records such as approvals, review decisions and remediation tickets.
• For sampled activities, preserve complete populations and supporting details so the auditor can decide what to test.
• Protect sensitive data and agree acceptable redactions and secure sharing arrangements with the auditor.
• Review failures and missing records throughout the examination period, not only at its end.

For concrete examples, use our SOC 2 evidence checklist. Learn how to identify and prioritize gaps in our readiness assessment guide.

5. Prepare for the examination

• Agree the scope, criteria, examination period, timeline and evidence requests with your CPA firm.
• Perform a readiness review and resolve or document exceptions. Keep a record of corrective actions and their dates.
• Prepare the system description and management’s assertion with the appropriate internal owners and professional guidance.
• Coordinate evidence requests and questions with the auditor. An independent CPA firm performs the examination and issues the report.
• Afterward, address findings and continue operating controls for the next reporting period.

Common questions

Is there an official SOC 2 certification?

SOC 2 is an examination resulting in a report issued by an independent CPA firm; it is not an ISO-style certification. Customers and auditors can clarify the exact report they require.

How long does SOC 2 readiness take?

It varies with your scope, existing practices, staffing, remediation and auditor availability. A Type II examination covers a period of operation; agree its length and timing with your auditor and intended report recipients.

Can software make us SOC 2 compliant automatically?

Software can help organize controls, collect evidence and highlight issues. People still need to design and perform controls, resolve exceptions, and work with an independent auditor.

Educational guidance, not an audit opinion or advice tailored to your organization. Discuss the applicable criteria, scope and evidence with your auditor.