The SOC 2 audit process, step by step

Choose the system the report covers, usually your product and the infrastructure, people and vendors behind it, and the Trust Services Criteria categories. Security is required. Add Availability if customers depend on your uptime, Confidentiality if you hold their confidential data, Processing Integrity if they rely on your calculations, and Privacy if you handle personal information under your own notice. Each category adds criteria, controls and audit cost, so add only what buyers ask for.

Compare what you have against the criteria before the auditor does. A readiness assessment, from a consultancy or an audit firm’s advisory team, usually takes four to eight weeks and ends in a gap list: missing policies, controls that exist but leave no evidence, controls that do not exist yet. If you want to see the list of what auditors expect first, read the SOC 2 checklist.

Write and adopt the policies, turn on single sign-on and multi-factor authentication, set up access reviews, change management, logging, vendor reviews, background checks and security training, and schedule a penetration test if your auditor or customers expect one. This takes anywhere from a few weeks to several months, depending on the starting point. It is the step most teams underestimate, because each control also has to produce evidence.

Only a licensed CPA firm can issue a SOC 2 report. Fees and fit vary more by firm than by report type: boutique and specialist firms often charge about $5,000 to $15,000 for a Type 1 and $7,000 to $25,000 for a Type 2 for a small company, national firms several times that. Book early; good small-company auditors fill their calendars months ahead. The questions to ask are in choosing an auditor.

For a Type 1 you agree a single “as of” date. For a Type 2 you agree the start and end of the observation period, commonly three months for a first report and six to twelve after that. Start only when the controls are running: every miss inside the period becomes an exception. Many teams do a Type 1 first and start the Type 2 period the day after.

The auditor sends a request list: policies, the system description, population lists (new hires, leavers, changes, incidents) and then samples drawn from them. Expect walkthrough meetings with the people who run each control and screenshots or exports of system settings. For a Type 2, some testing can happen during the period and the rest after it closes. Fast, complete answers to the request list are what keep fieldwork to weeks rather than months.

The auditor shares a draft. You check the system description for accuracy, write management responses to any exceptions and sign the management assertion. The final report follows, typically four to eight weeks after a Type 2 period closes. Be wary of promises of a two-week audit: the testing still has to be done.

A SOC 2 report covers a past date or period, so buyers expect a new one every year. Most companies move to a rolling twelve-month Type 2 period and issue a bridge letter for the gap between the end of one period and the next report. Controls have to keep running in between, which is where continuous monitoring pays off. See renewal and bridge letters.

The firm that issues your report cannot also build your controls; independence rules keep the two roles apart.