SOC 2 Readiness Versus a SOC 2 Audit

How the two fit together in sequence

Readiness and examination are not alternatives. They happen in order, and the order matters because an examination tests evidence that only exists if readiness produced it. A typical path looks like this.

Scope

Decide which product, systems, people, data, locations, and vendors are in scope, and which Trust Services Criteria apply. Security, the common criteria, is always included. Availability, Processing Integrity, Confidentiality, and Privacy are added only where customers or the business actually require them.

Gap analysis

Compare the criteria against how the organization currently operates, not against how a policy says it operates. This is where most of the real findings surface.

Remediation

Close the gaps. This is implementation work: configuring access controls, standing up logging, formalizing onboarding and offboarding, establishing vendor review, writing procedures people will actually follow.

Operate

Run the controls long enough to generate evidence. For a Type II, this is the observation period. Controls that were configured the week before the period ends will not produce a clean report.

Examination

An independent licensed CPA firm evaluates management's system description and tests the controls. SOC 2 examinations are assertion-based examination engagements performed under AT-C section 205, as amended by SSAE No. 21.

Why the same firm usually cannot do both

A CPA firm's independence can be impaired if it designed or implemented the controls it would then examine. That is the reason readiness and examination are typically separated between a readiness partner and an audit firm.

The boundary is not always intuitive, and it is the CPA firm's call, not the readiness partner's. Ask the firm directly what it can and cannot do while remaining independent, and get the answer before work starts rather than after. Discovering an independence problem late can mean re-running remediation with a different provider.

Where readiness goes wrong

• Scope set to impress rather than to match demand. Adding criteria nobody asked for multiplies the control and evidence burden with no commercial return.
• Policies written that do not describe real operations. A policy the team does not follow is worse than no policy, because the examination will test against it.
• Controls implemented without named owners. Unowned controls stop operating quietly, and the gap only appears during testing.
• Evidence treated as a final step. Evidence is a byproduct of controls running. It cannot be assembled retroactively for a period that has already passed.
• The observation period started too early. Beginning the clock before remediation is finished means the report covers a period that includes the gaps.

What readiness cannot do

Readiness does not produce a report, an opinion, or any form of assurance a customer can rely on. It cannot certify compliance, because SOC 2 is an attestation framework and there is no SOC 2 certification. It cannot guarantee the examination result, because the conclusion belongs to the CPA firm.

It also does not transfer responsibility. Management continues to own scope, risk decisions, policy approval, the accuracy of the system description, and the representations made to the auditor and to customers. A readiness partner prepares the facts, options, and evidence. The decisions remain with leadership.

This resource is educational and is not legal advice, an audit, or a guarantee of any examination outcome. Smart Biz iT supports readiness, implementation, and operations. Independent licensed CPA firms perform SOC 2 examinations and issue reports.