SOC 2 readiness assessment: what to expect and how to prepare

What is a SOC 2 readiness assessment?

A readiness assessment helps a service organization understand how its current practices compare with the criteria and commitments relevant to a proposed SOC 2 engagement. It may be performed internally or with a qualified advisor. Scope and deliverables differ, so agree them before work begins.

SOC 2 examinations use applicable trust services criteria and a description of the service organization’s system. The AICPA criteria and description criteria are useful references when discussing scope with the professionals involved.

A readiness review is a planning exercise; the independent CPA firm conducting the examination determines its own procedures and conclusions. A clean readiness assessment is not a guarantee of a particular audit opinion.

How the assessment works

1. Agree the intended outcome and scope

Collect customer requirements, intended report type, target dates and service commitments. Identify the services, data flows, systems, locations, people and vendors that support the proposed system. Confirm assumptions about relevant trust services categories with your auditor.

2. Understand how work is actually performed

Interview control owners and walk through real activities: for example, how a new employee receives access, how production changes are approved, or how an alert is investigated. Compare documented policy with the actual process.

3. Review controls and evidence

Map existing controls to the relevant criteria and commitments. Inspect representative records for context, dates, scope, approvals and exceptions. Review whether the organization can produce complete populations for auditor sampling. A single recent screenshot may be insufficient to show a recurring process operated over time.

4. Prioritize gaps and agree remediation

Record each gap, its business impact, proposed action, owner, target date and verification method. Distinguish a missing control from a control that exists but is not documented, is inconsistently performed, or lacks retrievable evidence.

5. Recheck and plan the engagement

Confirm changes are implemented, staff understand their responsibilities and records can be retrieved. Agree remaining issues, examination scope and timing with the independent CPA firm. For Type II, consider whether controls will operate consistently during the proposed period.

Readiness assessment preparation checklist

• Customer requests, proposed report type, deadlines and contractual commitments.
• A service overview, architecture diagram, data flows and inventory of supporting systems and vendors.
• Existing security policies, risk assessment, incident procedures and business continuity materials.
• Access lists and review records; change tickets and approvals; monitoring, incident and vulnerability records.
• Names of control owners across engineering, IT, security, operations, HR and leadership.
• Known exceptions, current remediation work and questions for the proposed assessor.

Not every item applies to every organization. Use the more detailed SOC 2 evidence checklist to organize records by control area.

Example: turn a finding into an action

For an illustrative SaaS company, a readiness reviewer finds that quarterly access reviews are performed but reviewer decisions are not retained. A useful gap register might contain:

Do not recreate missing historical evidence as though it existed at the time. Record the limitation and ask the auditor how it affects the engagement and proposed period.

How long does a readiness assessment take?

There is no universal duration. A narrow, well-documented environment can be reviewed faster than a complex multi-service environment; remediation may take longer than the assessment itself. Ask for separate estimates for assessment, remediation, control operation and the examination, and agree dependencies before setting a customer deadline.

What does it cost?

Costs depend on service scope, complexity, the amount of external assistance and the depth of review. Request a written proposal that separates readiness work from examination fees and explains deliverables, follow-up and assumptions.

Common questions

Is a readiness assessment required?

A separate readiness assessment is generally an optional preparation activity. Discuss whether it is useful for your circumstances with your advisor and CPA firm.

Can we assess readiness ourselves?

Yes. Internal teams can inventory controls and identify gaps. An experienced external advisor can provide another perspective; the examining CPA firm must retain responsibility for its own independent examination.

Can the readiness advisor also be our auditor?

It depends on the services provided and applicable independence requirements. Describe the proposed work to the CPA firm before engaging it, particularly if the advisor will design or operate controls on management’s behalf.

Does a readiness assessment replace a Type II period?

No. A Type II examination addresses control operation over the period covered by the report. See Type I vs. Type II for the distinction.

Educational guidance, not an audit opinion or advice tailored to your organization. Confirm scope, independence and evidence requirements with your professional advisors.