How an Audit Firm Conducts a SOC 2 Audit

What the firm is doing, and what it is not #

A SOC 2 engagement is an attestation examination. Not a financial statement audit. Not an inspection. Not a certification, since no SOC 2 certificate exists.

The work runs under the AICPA attestation standards, at AT-C section 105 and AT-C section 205. It measures your controls against the 2017 Trust Services Criteria with revised points of focus from 2022.

One point of precision. Many guides still cite SSAE 18 as the governing standard. SSAE No. 21 replaced AT-C section 205 for reports dated on or after 15 June 2022 and renamed it “Assertion-Based Examination Engagements”. Nothing substantive changed in how the audit runs. Citing AT-C 205 as amended keeps you right either way.

Independence comes first #

Before anything else, the firm tests its own independence. A CPA firm that built your controls cannot then audit them. This catches teams who hired one consultancy to do readiness and assumed the same people would sign the report.

So ask the question early. If a firm offers to write your policies and issue your opinion, that firm has a problem, and you inherit it.

Scoping decides most of the cost and most of the risk #

This is the phase of a SOC 2 audit that matters most, and the one teams rush. Five decisions land here, and three of them change what your report proves to a buyer.

1. The system boundary. Which products, environments and supporting processes sit in scope. Every system you add is evidence you owe for the life of the programme, not just this year.
2. The criteria categories. Security always. Availability, processing integrity, confidentiality and privacy only when a contract or your service calls for them.
3. The report period. Type 1 takes a date. Type 2 takes a window, and the choice between them sets your calendar.
4. Subservice organizations. Carve-out or inclusive. See below, because this one surprises buyers.
5. Complementary user entity controls. The controls your report assumes your customers run at their end.

Carve-out or inclusive #

Your cloud provider, your payroll platform, your data centre. The report has to say something about them, and there are two ways to do it.

Under the inclusive method, the subservice organization’s controls go into your system description and your auditor tests them. That needs the subservice organization to agree to testing and to sign its own assertion for your report. Coordination is heavy and few will do it.

Under the carve-out method, those controls come out of the description and out of the testing. A CPA firm puts the consequence for your buyer in one sentence.

“Your customers would then need to review your report for your controls as well as the subservice organization’s own report.”

SchellmanCPA firm, on the carve-out method

Carve-out is the most common method in SOC reports, so this is the normal case rather than the exception. Two things follow. Your description still has to name the controls you run to monitor that provider. And a carved-out report lists complementary subservice organization controls, the ones it assumes the provider operates.

How the auditor tests #

A SOC 2 audit uses four testing methods, in ascending order of strength.

The population matters as much as the sample #

Here is the request that stalls more engagements than any other. Before sampling, the auditor needs proof the population is complete.

If you claim 240 code changes in the window, the auditor wants evidence that 240 is every change, not the 240 someone exported. A list you typed into a spreadsheet is not a population. A query against the system of record, with the query shown, is.

What happens when a control fails #

The auditor records a deviation when a control did not operate as your description says it does. One missed access review inside a sample is a deviation.

Then comes the rule that surprises everyone. Remediation does not erase a deviation from a Type 2. The period has already closed. You can fix the control today and the report still names what happened during the window. The report describes that window and nothing else.

This is not fatal. A report with two deviations and a clear management response often reads better to a buyer than a spotless one. It shows the control set is real and the testing had teeth. What you can do is put your response in the report, which brings us to the sections.

The four opinions #

1. Unqualified. The controls were suitably designed and, in a Type 2, operated effectively. This is the clean one and the one most engagements reach.
2. Qualified. Everything holds except for specified matters. The opinion names them. Buyers read the exception and ask about it, and that conversation is survivable.
3. Adverse. The controls did not meet the criteria. Rare, and the report is not one you send out.
4. Disclaimer. The auditor could not gather enough evidence to form an opinion. Often a scope or evidence failure rather than a control failure.

The five sections, and the one outside the opinion #

Every SOC 2 report has the same shape. Who writes each section tells you how much weight it carries.

That last row is worth a paragraph of its own, because most readers never notice it.

“Information in this section is not covered by the service auditor’s report.”

K·Coe IsomCPA firm, on Section V of a SOC report

Section V is where management puts roadmap items, services outside the engagement, framework mappings, marketing claims, and responses to the deviations in Section IV. The auditor reads it for inconsistency with the rest of the report and expresses no opinion on it.

So the deviation sits in Section IV under the opinion, and the reassuring explanation sits in Section V outside it. That is a legitimate and useful place to answer a finding. It is also the first place to look when a vendor’s report reads better than its testing results suggest it should.

Dating, and the gap that follows #

A Type 2 covers a closed period, so the report starts ageing the day it arrives. Buyers treat a report as current for about 12 months after the period end. A gap between one period and the next reads as a lapse.

For the months between the period end and today, buyers ask for a bridge letter. Management signs it, not the auditor, and it asserts that nothing material changed. Enterprise buyers cap what they will accept at around three months. Regulated buyers often refuse one outright.

What a clean opinion does not cover #

Four gaps, and a buyer who knows the format will probe all of them.

1. Carved-out subservice organizations. Your auditor never tested your cloud provider’s controls. Offer that provider’s report alongside yours.
2. Complementary user entity controls. The report assumes your customer runs certain controls at their end. If they do not, the chain breaks, and no opinion covers that.
3. Section V. Unaudited by definition. Read it as management’s words, because that is what it is.
4. Privacy law. The privacy category uses the AICPA criteria. Those are not PIPEDA, PHIPA, Quebec Law 25, HIPAA or any state privacy statute. A clean SOC 2 says nothing about whether you meet them.

One cross-border note. Every SOC report comes from a licensed CPA firm, and a Canadian firm can issue one under the same standards. CPA Canada publishes its own SOC 2 guide, and a report signed in Toronto carries the same weight with a buyer in Atlanta. For what a SOC 2 audit costs, see what a SOC 2 Type 2 report costs. For how long it takes, see the SOC 2 Type 2 timeline.

Frequently asked questions #

Key takeaways #