SOC 2 audit

SOC 2 audit process: what happens at each stage

Most guides give three steps. This one walks the stages in order and shows what you do, what the auditor does and what you hand over at each.

Tell Us What You Need Jump to the stages

Free for buyers · provider-funded introductions · Updated October 2026

At a glance

ForTeams about to start a SOC 2 examination

CoversEight stages from scoping to the final report

You end withA list of what to prepare and who does what

It is notA promise of timing or of a clean opinion

The short answer

What is the SOC 2 audit process?

A SOC 2 audit is an examination of your controls by a licensed CPA firm against the Trust Services Criteria. It typically runs from scoping and a system description, through evidence requests and testing, to a draft report, management letters and the final report. Which stage takes longest depends on your report type and how ready your evidence is.

Type 1 tests design at a date. Type 2 tests operation over a period.
You supply a system description, management’s assertion and evidence.
The auditor tests, forms an opinion and issues the report. Stage names vary by firm.

The stages

Eight stages, and who leads each

Colour shows who leads. Both sides are involved in most stages.

SOC 2 audit process in eight stages: scope and engage, readiness, system description, request list, evidence, testing, draft and exceptions, final report, coloured by whether you, the auditor or both lead each stage. — The eight stages, coloured by who leads.

SOC 2 audit stages with what you do, what the auditor does and what you hand over
Stage	You do	The auditor does	You hand over
1. Scope and engage	Choose report type, criteria and system boundary. Sign the engagement.	Agrees scope and terms.	Scope decisions and a system overview
2. Readiness (optional)	Run a gap assessment and fix gaps. See the readiness checklist.	Stays independent of any advisory work.	A list of gaps with owners
3. System description	Draft the system description and management’s assertion.	Reviews them for completeness.	System description and assertion
4. Request list	Assign an owner and date to each request.	Builds an information request list (often called PBC) from scope, criteria and any prior report.	Owners and due dates
5. Evidence	Provide policies and populations such as joiners, leavers and changes.	For Type 2, samples from the populations.	Populations and sample evidence
6. Testing	Explain how controls work and answer questions.	Inquiry, observation, inspection and re-performance.	Tickets, logs, screenshots and clarifications
7. Draft and exceptions	Review the draft and respond to exceptions.	Documents exceptions and drafts the opinion.	Management responses
8. Final report	Sign management’s assertion and representation letters.	Makes a subsequent-events inquiry, then issues the report.	Signed letters

Stages follow common practitioner descriptions, such as Drata’s overview. Firms differ on names and order, so ask yours for its engagement plan.

The result

What the report contains

The deliverable is a report with an opinion, not a certificate.

Typical sections of a SOC 2 report
Section	What it is
Auditor’s opinion	The CPA firm’s conclusion. It can be unmodified or modified (qualified, adverse or a disclaimer).
Management’s assertion	Your statement about the system and controls, signed by management.
System description	Your description of the service, boundaries, criteria and controls.
Tests of controls and results	What was tested and what was found. Exceptions appear here.

There is no pass or fail grade. Exceptions are reported, and the opinion reflects them. Reports are usually shared with customers under NDA.

Prepare

What to have ready, and what goes wrong

Most delays come from preparation, not testing.

Name an owner for every control and every request before fieldwork.
Keep evidence as controls run. Rebuilding it afterwards is slow and may not be accepted.
Prepare populations early. Auditors sample from complete lists.
Agree scope and criteria in writing before the window opens. See Trust Services Criteria.
Keep advisory help and the audit separate. See SOC 2 vs ISO 27001 for how to verify who signs.

FAQ

SOC 2 audit process questions

What is a SOC 2 audit?

An examination by a licensed CPA firm of your controls against the Trust Services Criteria. It ends with a report that contains the firm’s opinion.

Who performs a SOC 2 audit?

A licensed CPA firm. Advisors and automation tools can help you prepare but do not issue the opinion. Ask any provider which firm signs the report.

What is a PBC or information request list?

The auditor’s list of documents, populations and evidence to provide. It is built from your scope, the criteria and any prior report.

What happens if there are exceptions?

They are documented in the tests-of-controls section with your response. There is no pass or fail grade, but exceptions can affect the opinion, so fix gaps before the window opens.

Do I need a Type 1 report first?

Not always. It depends on what your customers accept. See Type 1 vs Type 2.

Who sees the report?

Usually customers and prospects, under NDA. A SOC 3 report is a general-use summary.

Start here

Start with the requirement, not the auditor.

Requirement→Scope→Price→Matched provider

Tell Us What You Need

Free for buyers · provider-funded introductions