Your Step-by-Step SOC 2 Audit Checklist

One of the best security frameworks organizations can follow — especially those that do most of their business in North America — is System and Organization Controls 2 (SOC 2). It offers flexibility in compliance without sacrificing security rigor.

However, complying with SOC 2 requires you to undergo a deep audit of your organization’s systems, processes, and controls. Preparing for such an undertaking is no easy feat.

To help you out, we’ve compiled a checklist of pre-audit steps you can take to maximize your chance of passing that audit and gaining the ability to say you’re SOC 2 compliant.

What is a SOC 2 audit?

The American Institute of Certified Public Accountants developed SOC to provide security standards for internal controls.

SOC 1 deals with financial reporting controls, but SOC 2 is concerned with information security controls — especially those surrounding customer data.

SOC 2’s compliance requirements consist of five trust service principles:

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

The SOC compliance audit is the process you undergo to see if you meet SOC compliance guidelines. SOC 1 audits and SOC 2 audits are for the same purpose, just for different frameworks.

At the end of the SOC 2 audit, you receive a SOC 2 report containing the auditor’s opinion about whether you adhere to the trust principles specified. 

There are a few types of opinions they may offer:

• Unmodified opinion: No material inaccuracies or flaws in systems. This is your goal.
• Qualified opinion: There are material misstatements in system control descriptions, but they’re limited to specific areas. 
• Adverse opinion: There is sufficient evidence that there are material inaccuracies in your controls’ description and weaknesses in design and operational effectiveness.

There are two types: SOC 2 Type I and SOC 2 Type II.

• Type I: Design effectiveness of controls at a single point in time.
• Type II: Design and operational effectiveness of controls over a period of time between 3 to 12 months.

Type II more accurately measures controls in action, whereas Type I simply assesses how well you designed controls.

Passing a SOC 2 compliance audit means you’re compliant with whichever trust principles you specified. This reassures you that your chances of going through a data breach are minimal. 

You can use this as a marketing tool as well, showing prospects that you’re serious about data security.

However, the SOC 2 audit is a significant investment of time, money, and organizational resources. 

Not only do you have to undergo the audit itself, but you must make extensive preparations if you want to pass. You must prepare by finding out where you are relative to what complies with your desired SOC 2 trust principles. This includes identifying the gaps and charting your course to close them before the audit. 

These preparations don’t happen overnight — they can take several weeks to several months.

Even when controls are in place, you must ensure your team begins to adopt best practices for information security throughout your organization to maximize your chances of passing the audit. 

What happens during the SOC 2 audit?

Before the audit, your auditor will likely work with you to set up an audit timeframe that works for both parties. 

They may also talk you through the audit process. This will ensure that you know what to expect. The auditor may even ask for some initial information to help things go more smoothly. 

Once they arrive, here’s the general process:

1. The security questionnaire

Many auditing firms start by administering a questionnaire to you and your team. 

This contains many questions regarding company policies, procedures, IT infrastructure, and controls. 

Getting your team into good security habits as early as possible before the audit helps out here. They’ll be able to answer questions with confidence.

2. Gathering evidence of controls

Next, auditors will ask your team to furnish them with evidence and documentation regarding the controls within your organization. 

You need proof of every policy and internal control to demonstrate that things are up to par. The auditors use this as part of their evaluation to understand how controls are supposed to work.

3. Evaluation

During the evaluation, the auditors might ask the owners of each process within your SOC 2 audit scope to walk them through your business processes to understand them better. 

4. Follow-Up

SOC 2 audits are intensive. As a result, auditors often uncover matters for which they need more evidence, despite all the prep work. 

They may ask your team for clarification on processes or controls, or they may want additional documentation. 

In some cases, if the auditor notices obvious compliance gaps that can be fixed relatively quickly, they could ask you to remedy those before proceeding. 

The auditors will document their visit as well, just in case further follow-up is needed.

5. The SOC 2 report

When the audit concludes, the auditing firm will issue you a SOC 2 audit report. 

There is no formal SOC 2 certification. Instead, the main portion of the report contains the auditor’s opinion regarding the effectiveness of your internal controls as they pertain to your specified trust principles.

Who can perform SOC 2 audits?

Since the AICPA created the SOC security guidelines, any CPA firm can perform your audit for you. 

However, you’ll want to pick a CPA firm that specializes in information systems.

If you currently work with a firm that lacks CPAs with information systems knowledge and experience, your best bet is to hire a different firm for the audit. Your current firm may be able to provide some advice on preparations, but engaging with a firm that specializes in information security work will increase your chances of passing the audit. 

It’s worth noting that because there’s no formal certification, hiring a CPA firm with more SOC 2 experience can bring more prestige to the end result, maximizing your reputation among customers. 

That said, you will have to pay more for a more renowned firm.

Your 5-step checklist to prepare for and pass your SOC 2 audit

Preparing for the audit can take much more work than actually undergoing it. To help you out, here is a 5-step checklist for becoming audit-ready.

1. Determine your SOC 2 audit scope and objectives

The first part of preparing for your SOC 2 audit is defining the scope and objectives. 

SOC 2 audits look at infrastructure, data, people, risk management policies, and software, to name a few items. You must determine who and what within each of these categories will be subject to the audit. 

Additionally, picking your scope involves deciding between Type I and Type II reports.

Recall that Type I is less intensive because it only analyzes design effectiveness as of one date. That means it’s not as reputable.

On the other hand, Type II is more intensive, but it offers a better idea of how well your controls are designed and their operational effectiveness — both of which are more marketable. 

Pick Type II if you care more about how well your controls function in the real world. Additionally, customers typically prefer to see Type II reports, given their increased rigor.

If you’re more concerned with simply having well-designed controls and would like to save resources, pick Type I.

2. Select your trust services criteria

SOC 2 audits evaluate your controls within the audit scope mentioned earlier against the trust services criteria set out by the AICPA. 

Recall that five trust services criteria make up the SOC 2 compliance requirements:

• Security: Protecting information and systems against unauthorized access, disclosure of information, or other mishandling/damage.
• Availability: Information and systems can meet your organization’s service objectives — such as those laid out in service-level agreements — and are available for operation.
• Processing integrity: Your systems perform their functions completely, accurately, validly, timely, and in a way that meets your organizational objectives.
• Confidentiality: You collect, use, retain, disclose, and dispose of non-personal data and information properly.
• Privacy: You collect, use, retain, disclose, and dispose of peoples’ personal information properly.

Fortunately, you don’t have to undergo an audit for all five at once. The only mandatory principle is security.

If you’re short on resources for the audit, pick criteria alongside security that offer the highest potential ROI or those you’re close to achieving without much additional work. 

You can go for all five at once if you’re able; just keep in mind that the audit scope and cost will increase with each trust principle you add.

3. Run an initial readiness assessment

A readiness assessment is like a practice version of the real SOC 2 audit. 

You can do one on your own if you know how, but bringing in an auditor is often the better choice since they have the expertise and an outside perspective.

The auditor walks through all of your systems, processes, and controls, documenting key processes that would be in the official audit.

In the end, they issue a management letter detailing any weaknesses or deficiencies found that pertain to each trust service requirement, along with some recommendations for fixing them. 

The initial readiness assessment helps you find any areas that may need improvement and gives you an idea of what the auditor will look at. 

Of course, the auditor can’t help you fix the weaknesses or implement suggestions directly. This would threaten their independence — they cannot objectively audit their own work. 

That part is up to you, which is where the next step comes in.

4. Perform a gap analysis and close each gap

After performing that initial readiness assessment, you’ll want to perform a gap analysis.

This involves looking at where you stand based on your initial readiness assessment, what compliance looks like in terms of your SOC 2 trust criteria, then fixing any problems that you find to bring you to SOC 2 standards before the actual audit.

Gap analysis and correction can take a few months. Some activities you may identify as necessary in your gap analysis include:

• Implementing controls
• Interviewing employees
• Training employees on controls
• Creating and updating control documentation
• Modifying workflows

Like with the readiness assessment, you may be able to outsource your gap analysis to another firm specializing in this process. 

It will require additional financial investment, but it can save you time and provide you with an external expert.

5. Conduct a final readiness assessment

Finally, after closing any gaps between you and SOC 2 compliance, you might want to do one more readiness assessment. 

Hopefully, this one goes smoother, and there are far fewer weaknesses. 

If there are still weaknesses present, patch those up real quick. 

Once you feel you’ve addressed everything relevant to your scope and trust services criteria, you can request a formal SOC 2 audit.

Hopefully, your hard work pays off, and you get a SOC 2 report with an unmodified opinion for every trust principle you chose.

Get ready to pass your SOC 2 audit

You have a lot ahead of you when preparing for your SOC 2 audit. It will take a significant investment of time, money, and mental energy. However, following the steps laid out in this checklist can make that journey a little clearer.

However, if you’d like hands-on guidance and a platform that cuts your prep time from months to weeks, Secureframe can help. 

Request a free demo today or reach out to sales@secureframe.com to learn more about how Secureframe can make the SOC 2 audit preparation process a lot easier.