Demonstrate How Your Controls Operate Over Time
SOC 2 helps service organizations communicate how their controls address commitments to customers and the requirements of the systems used to deliver services. The examination uses the AICPA Trust Services Criteria relevant to the engagement.
A Type I report addresses control design at a specified date. A Type II report also addresses operating effectiveness over a defined period. Preparation therefore includes both implementing controls and retaining evidence that they operated during the examination period.
- Define the service, system boundaries, and commitments in scope.
- Select the relevant trust services categories with your CPA firm.
- Retain evidence throughout the agreed examination period.
Official guidance: AICPA SOC suite of services.
Make Every Control Traceable to Its Evidence
A written policy establishes an expectation; operating records show what happened. For an access-control activity, for example, preparation may include the policy, the review population, reviewer approvals, and records showing that inappropriate access was removed.
Use the same discipline for changes, incidents, supplier reviews, and other activities in scope. Retain dates, owners, approvals, and supporting records so your CPA firm can select and test evidence from the examination period.
Treat gaps as work to resolve and document. The examination’s conclusions depend on the evidence and the auditor’s evaluation, rather than the completion percentage of a readiness dashboard.
Official guidance: AICPA Trust Services Criteria.
The Five Trust Services Categories
Security provides the common criteria used in a SOC 2 engagement. Additional categories depend on the services, commitments, and scope of the examination.
Security
Protect systems and information from unauthorized access and actions that could compromise service commitments.
Availability
Address the availability of systems used to meet commitments and operational requirements.
Processing Integrity
Address whether processing delivers complete, accurate, authorized, and timely results.
Confidentiality
Protect information designated as confidential under the organization’s commitments.
Privacy
Address the handling of personal information across collection, use, retention, disclosure, and disposal.
Official guidance: AICPA Trust Services Criteria.
Prepare for the Examination, Then Sustain the Program
A useful readiness program connects the scope of the report to the people who perform controls and the records they retain. Confirm engagement decisions with your CPA firm.
For Leadership
Set the service commitments, assign accountable owners, and plan the resources needed to sustain controls.
For Engineering and Security
Build evidence capture into access reviews, change management, monitoring, and incident response workflows.
For Audit Coordinators
Align the system description, control inventory, evidence requests, and examination timeline with your CPA firm.