SOC 2 audit process: steps from engagement to report

How the SOC 2 audit process runs from engagement to report

A CPA firm performs the SOC 2 examination, tests management's description of the system and its controls, and issues the report. The organization owns its controls and prepares the evidence the auditor will test, and no implementation partner or tool vendor can issue the report. Your path through the examination depends on four things: whether you need a Type 1 or Type 2 report, which Trust Services Criteria categories are in scope beyond security, how many systems and locations the report covers, and how ready your evidence is on the first day of fieldwork. A single cloud product with one production environment and clean access records follows a very different course from a multi-product platform with several subservice organizations and undocumented change approvals, even when both start from the same engagement letter.

The examination is assertion-based under AT-C section 205, so management must make a written assertion about the system description and controls, and provide written representations to the service auditor. The AICPA's SOC 2 guide, updated on October 15, 2022 for SSAE No. 20 and No. 21, is the current reference for how the engagement is structured and reported, and the AICPA SOC 2 guide is the natural next read for your auditor's engagement team. Before signing, ask the firm to walk through the sequence it will follow: planning and risk assessment, the evidence requests, the written representation letter, fieldwork and sampling, and the draft report review. Confirm with the firm how it will handle the period between your intended start and report date, since that drives the fieldwork calendar and the staff time you must reserve.

Two items deserve attention before the engagement starts. First, confirm which parts of the process your organization will carry itself and which the firm expects a readiness adviser or tool platform to prepare, because the firm cannot both design the controls it later tests and act as their independent examiner. Second, ask for the firm's own written timetable and document request list, and check those against the AICPA's current proposals for the attestation standards, which the Journal of Accountancy reported in February 2026 would apply to engagements beginning on or after June 15, 2029 if adopted. Treat that date as something to verify with your auditor, not as a planning assumption for an examination starting now.

What happens in each phase of a SOC 2 examination

A SOC 2 examination moves from an agreed scope to a signed report in a fixed sequence, and each phase produces a document or record that the next phase depends on. Knowing those outputs lets you see where your team's effort goes and where an independent CPA firm takes over.

Agree the engagement letter and scope
The service organization and the CPA firm agree in writing which system, services, locations, trust services categories and subservice organizations are in scope, and whether the report is a Type 1 or a Type 2. Management owns the scope decision, and the CPA firm confirms it can perform the examination. The output is a signed engagement letter that defines the examination and the responsibilities of each party. Ask the firm to explain how it will handle independence if a consultant also prepares your controls.
Prepare the system description and written assertion
Management writes the description of the system under the 2018 description criteria (DC 200), covering the services, infrastructure, software, people, procedures and data within scope, along with the controls it relies on and any complementary user entity controls. Management then prepares its written assertion stating that the description is fairly presented and that the controls are suitably designed, and operating effectively for a Type 2. The output is a draft description and assertion that the CPA firm reviews and comments on before fieldwork.
Complete the risk assessment and control design review
The CPA firm evaluates the control environment and the risks to the service commitments and system requirements, then reviews whether management's controls map to the relevant Trust Services Criteria and address those risks. Management's control matrix and policies are compared with the criteria, and gaps are identified for remediation before testing begins. The output is the CPA firm's understanding of the design of controls, a list of design gaps, and the agreed plan for testing. Confirm with the firm how it documents the risk assessment, since the AICPA's 2022 guide updated this guidance.
Test controls over the examination period
For a Type 1 report, the CPA firm tests whether controls were suitably designed and in place as of a specific date. For a Type 2 report, the firm tests whether controls operated effectively across the observation period, typically by selecting samples of items and inspecting evidence such as access reviews, change tickets, logs and training records. Management supplies populations and evidence on request, and exceptions are discussed as they arise. The output is a set of documented test procedures, results and any exceptions, which become the tests of controls section of the report. The length of this phase depends on scope, the number of controls and the observation period, so check the timeline guidance before committing dates.
Sign the written representation letter
At the close of fieldwork, management signs a representation letter addressed to the service auditor. AT-C section 205 requires written representations from the responsible party in an assertion-based examination, and the AICPA's illustrative Type 2 letter adds representations specific to a SOC 2 Type 2. Management confirms, among other things, that it has disclosed known instances of noncompliance, incidents and control deficiencies. The output is a signed letter dated at the end of fieldwork, which the CPA firm relies on before issuing its opinion.
Issue the CPA firm's report
The CPA firm evaluates the test results, the description and the representation letter together, then decides the form of its opinion, including whether any exceptions qualify it. The firm issues the report, which typically contains management's assertion, the description of the system, the service auditor's report, and the tests of controls and results. Only the CPA firm issues this report, not the consultant or the compliance platform that supported the work. The output is the final signed report, which the organization can then share under its distribution terms.

Who does what during the examination

Your organization is the service organization and the responsible party. Management owns the controls, decides how the system is described, and answers for the assertion that the description is fairly presented and the controls are suitably designed and, for a Type 2, operating effectively. No outside party can take that responsibility from you, so the people who sign must understand what they are signing.

Owning the controls: Named control owners run each control day to day, keep it operating and produce the records the auditor samples.
Writing and approving the description: Management prepares the system description against the 2018 description criteria and confirms that it matches how the system really runs.
Signing the assertion: Management signs the written assertion that the description and controls meet the criteria, which is included in the report.
Signing the representation letter: Management gives written representations to the CPA firm, including the additional representations in the AICPA's illustrative Type 2 letter, and the letter must be accurate on its date.
Answering the auditor: Staff who understand each system respond to evidence requests, explain exceptions and tell the auditor about changes during the period.

Before fieldwork starts, confirm which named people sign the assertion and letter and that each control has a single accountable owner.

Why management's assertion and written representations carry weight

A SOC 2 is an assertion-based examination under AT-C section 205 of the AICPA attestation standards, so the service auditor forms its opinion on management's written statements as well as on its own testing. The subject of the opinion is management's description of the system, and management makes a separate written assertion that the description is fairly presented and that the controls described were suitably designed and, for a Type 2 report, operated effectively over the period. Those two documents are the organization's statements, not the CPA firm's. Before fieldwork starts, the team should confirm which system boundary the description covers and who in leadership owns each statement about it.

The auditor also requests a representation letter, addressed to the service auditor, in which management confirms specific facts such as that it has disclosed known instances of noncompliance, known security incidents, and communications from regulators or customers that affect the controls. The AICPA's illustrative Type 2 letter applies to reports dated on or after June 15, 2022. It includes the representations AT-C section 205 requires and adds representations specific to a SOC 2 Type 2 examination. Management, not the CPA firm, must be able to stand behind each statement, so each representation should be traced to evidence the organization can produce.

Have legal counsel and senior leadership review the letter and the assertion before anyone signs. Ask who will confirm each representation internally, what records support it, and what happens if a statement later proves inaccurate, including whether the report would need to be revisited. Where a representation cannot be made without qualification, raise it during the readiness work rather than at signing, because an undisclosed gap can surface as an exception in the report or damage the organization's credibility with customers who rely on it.

What the final SOC 2 report contains, part by part

A SOC 2 Type 2 report follows the same four-part shape in the AICPA's illustrative example. Management writes two of the parts, the CPA firm writes one and tests the rest, and a reader should check each part against the others before relying on the report.

Management's assertion

Management's assertion is a written statement, signed by the service organization's management, that the description of the system is fairly presented and that the controls operated effectively as the criteria require. Management prepares it, not the CPA firm. Check that the assertion covers the same system, categories and period as the rest of the report, and that it names any subservice organizations it relies on. A mismatch in dates or boundaries is a first sign that the parts were not prepared together.

The description of the system

Management prepares the system description under the 2018 description criteria, which ask what services the system provides, how it is built, and which controls operate around it. The criteria do not prescribe a format, so layouts vary between reports. Check that the description is fairly presented, that it covers the infrastructure, software, people, procedures and data in scope, and that it lists complementary user entity controls and any subservice organization carve-outs, so you know which controls are the customer's responsibility and which are the provider's dependency.

The service auditor's report and opinion

The CPA firm writes the service auditor's report, which states the opinion on whether the description is fairly presented and whether the controls were suitably designed and operated effectively over the period. The opinion is the CPA's conclusion, not a pass or fail stamp on the company. Read the opinion first, then check whether it is unmodified, and whether any qualification or exception is described in it. Confirm the CPA firm is licensed and identify the period the opinion covers.

Tests of controls and results

This section lists each control, the test the CPA firm performed, the sample or population used, and the result. Exceptions appear here, even when the opinion is unmodified, so this is where a reader sees what did not work as designed. Check the number and nature of exceptions, whether they were remediated, and whether any carve-out subservice control was tested at all. A clean-looking table with no exceptions over a long period deserves a question about how the sample was drawn.

How the Type 1 and Type 2 processes differ

This table compares how a Type 1 and a Type 2 examination run, from the date or period covered to the evidence the CPA firm tests and the report the reader receives. Read it as a sequence of process steps, then use the Type 1 versus Type 2 page to decide which report fits your customers.

Process step	SOC 2 Type 1	SOC 2 Type 2
Period covered	A single point in time (as of a date)	A defined observation period, with controls tested across that window
What management describes	The system description as of the date, including the services, infrastructure and controls in scope	The system description for the full period, showing how the system and controls changed over it
What management asserts	Management's written assertion that the description is fairly presented and the controls were suitably designed as of the date	Management's written assertion that the description is fairly presented, controls were suitably designed and operated effectively throughout the period
What the CPA firm tests	Whether controls are designed to meet the applicable criteria and are in place on the date	Whether controls operated as designed across the period, using samples drawn from the whole window
Evidence that must exist	Design documentation and proof that controls existed on the as-of date	Records for the full observation period, so the controls can be tested at multiple points in time
Written representations	Management representations addressed to the service auditor under AT-C section 205	Representations under AT-C section 205 plus the additional representations in the AICPA's illustrative Type 2 letter
Output the reader receives	A report with management's assertion, the system description, the service auditor's opinion on design	A report with management's assertion, the system description, the service auditor's opinion, and tests of controls and results
Process-driven cost factors	Scope size, readiness work and the number of controls that need design evaluation	Length of the period, sample volume, and how many control owners must produce recurring evidence
Who to confirm details with	The CPA firm's engagement letter and its fee schedule for the as-of date	The CPA firm's engagement letter, observation window and sampling approach before fieldwork starts

What must be in place before fieldwork starts

Fieldwork starts when the auditor begins testing, and the work done before that point decides how much of it is spent on gaps. The six items below connect: the system description defines what is tested, the control set maps to the criteria, and the evidence and owners show that controls operate. Check each one before the auditor arrives, and use the readiness assessment and evidence pages for depth.

A settled system description and scope

Management needs a written description of the system, its services, infrastructure, people, data flows and locations, plus a clear boundary showing what is in and out of scope. Check that the boundary matches the actual production environment, that the in-scope categories are confirmed, and that engineering, support and finance describe the system the same way. A description that changes during fieldwork forces the auditor to retest. For the detailed requirements, see the SOC 2 system description and scope pages.

Controls mapped to the criteria

Each control in the matrix should trace to the Trust Services Criteria for the categories in scope, with the common criteria CC1 to CC9 covering security in every report. Check for gaps where a criterion has no control, and for controls that exist only on paper. The matrix should name the control, the criterion it addresses, the frequency and the evidence produced. Points of focus help design controls but are not a checklist to satisfy one by one.

Policies and procedures in actual use

Written policies only count if people follow them during the period the auditor will test. Check that each policy has an approval date and an owner, that staff have acknowledged it, and that the process it describes is visibly happening. An information security policy that nobody references, or an incident procedure that has never been run, will generate exceptions. Confirm that the documents match how the team actually works today.

Evidence the auditor can sample

Auditors select samples and ask for proof, so the records must exist and be retrievable. Typical items include access review sign-offs, approved change tickets, system and security logs, training completion records and incident tickets with resolution notes. Check that a sample from each control can be pulled within a day, that dates fall inside the review period, and that records are complete. The evidence pages cover collection in detail.

Subservice organizations and their reports

Cloud hosts, data processors and other vendors that perform controls for the service organization must be identified. For each one, confirm whether the subservice organization is included or carved out, collect its current SOC report or equivalent evidence, and document the complementary subservice organization controls that management relies on. Check the report dates against the examination period and note any exceptions the vendor reports, since those affect the reliance you can place on them.

A named owner for each control

Every control needs one accountable person who performs or oversees it, reviews its evidence, and raises problems when it fails. Check that each owner has accepted the role in writing, understands what the control requires and how often it runs, and can explain the control to the auditor without a referral. Ownership gaps usually show up as missed access reviews or unreviewed change tickets, which become exceptions in the report.

What the proposed attestation changes could mean for future engagements

The AICPA Auditing Standards Board exposed proposed revisions in February 2026 to AT-C 105 (common concepts), AT-C 205 (assertion-based examinations) and AT-C 210 (reviews). These are proposals, not current requirements. If adopted, the revisions would apply to engagements beginning on or after June 15, 2029, and comments on the exposure draft were due June 30. Any SOC 2 examination you start before that date continues to follow the attestation standards in force today and the October 2022 SOC 2 guide, including the written representations that AT-C 205 requires from management.

Because AT-C 205 is the standard that governs the representation letter, the most likely practical effect on your engagement is in the wording and timing of management's representations and in how the CPA firm documents its work. Ask your CPA firm now whether it expects any changes to its engagement letter, its illustrative representation letter, or the procedures it will perform, and whether it will update those documents if the revisions are finalized before your examination period ends. Confirm who on your side signs the representation letter and whether that person has been briefed on its contents.

Plan to recheck your assumptions when the standards are final rather than treating the exposure draft as settled. Put a recurring review on your compliance calendar that compares the final text against your engagement letter, your control matrix and your evidence requests, and log the result. If your next Type 2 period or contract renewal falls near 2029, raise the question with your CPA firm early, because the firm's own transition plan will determine how the change reaches your report.

What delays a SOC 2 examination and how to avoid it

Most delays in a SOC 2 examination trace back to a few preventable gaps: the boundary of the system was never settled, the paperwork was written after the controls ran, or evidence existed but no one could retrieve it. Each cause below has a practical fix that the organization owns, even when an implementation partner helps prepare the materials.

Unsettled system boundary

If the team has not decided which products, environments, locations and subservice organizations belong in the system, the CPA firm cannot finish planning and fieldwork. Scope keeps moving, sampling populations change and controls get added late. Freeze the system boundary and the categories in writing before the engagement starts, and record any later change with its date and approver so the auditor can see when the scope moved.

System description written after controls

A system description drafted from memory or from a policy binder often disagrees with how the platform actually runs. Each disagreement becomes a question from the auditor and sometimes a rewrite. Draft the description from the operating environment: the actual infrastructure as code, deployment pipeline, identity provider and access paths. Walk each component with the engineer who runs it before management signs.

Evidence that cannot be produced

A control can work every day and still fail an examination if the proof cannot be pulled on request. Logs rotate out, tickets lack approvals, and access reviews live in someone's inbox. Assign one evidence owner per control, define where the record lives and how long it is kept, and run a practice request before fieldwork to confirm each item can be produced within the time the auditor expects.

Missing subservice organization reports

A cloud provider, hosting vendor or payment processor that performs part of the controls usually has its own SOC report. If that report was never requested, reviewed or matched to the complementary controls, the auditor must stop and gather it. Collect each subservice organization's current report early, note its period and any exceptions, and map which of your controls depend on it.

Exceptions that were not planned for

An exception occurs when a tested control does not operate as designed. Exceptions are not automatically fatal, but an unexpected one in a Type 2 period can lead to a qualified opinion or extra sampling. Before the observation period starts, run internal tests on high-risk controls such as access reviews and change approvals, record every deviation, and agree with the auditor how a deviation will be documented and remediated.

Late representation letter review

The responsible party must sign a written representation letter addressed to the service auditor, and the AICPA's illustrative Type 2 letter lists the statements management is asked to make. If management first reads it at the end of fieldwork, statements may be untrue or unsupported, and the report date slips. Give legal counsel and the control owners the draft letter early, and confirm each representation against evidence before the report is finalized.

Questions buyers ask about the SOC 2 audit process

Who issues the SOC 2 report and who signs the representation letter?

Only an independent CPA firm issues the SOC 2 report and its opinion. The service organization's management writes the system description and its own assertion, and management signs the written representation letter addressed to the service auditor. AT-C section 205 requires the service auditor to request these written representations from the responsible party, so the signatory should be an executive who can speak for the system and its controls. The AICPA's illustrative Type 2 representation letter shows the representations that are typically covered. Neither a consultant nor a compliance platform can sign on the auditor's behalf or replace the CPA firm's report.

What must our team do itself, and what can an implementation partner prepare?

Your organization owns its controls, its policies, its risk decisions and its system description. An implementation partner can help build and configure the technical controls, collect and organize evidence, and prepare documentation for the examination, but it cannot issue the report or attest that controls operate. In practice, your team should keep the control owners, approve policies, decide scope and sign management's assertion. Items usually handed to a partner include access configuration, logging pipelines, backup and recovery setup, change management tooling and evidence packs. Confirm in writing which tasks the partner performs, which your staff performs and who reviews the output before it reaches the CPA firm.

Can a SOC 2 audit run without a readiness phase?

Technically a CPA firm can begin examination fieldwork against controls that already exist, but the readiness phase is where gaps surface before testing begins. Without it, the auditor may find missing evidence, undocumented controls or a system description that does not match production, and those findings can appear as exceptions in the report. A readiness assessment, which is a separate engagement from the examination, lets you map controls to the Trust Services Criteria and fix weaknesses first. Ask the CPA firm how it handles readiness work it might be asked to help with, because independence limits apply when the same firm prepares and attests. The AICPA SOC 2 overview is a good starting point for the report's structure.

What does the Type 2 observation period require from the team each week?

A Type 2 report tests whether controls operated effectively across a period, so the work is continuous rather than a single push before the audit. Each week, control owners perform the recurring activities your controls describe, such as reviewing access, reviewing alerts, approving changes and tracking vulnerabilities, and each activity leaves a record. Someone must check that tickets, approvals and logs are complete and that exceptions are documented and corrected. Problems found mid-period, like a missed access review, are better handled and recorded as they happen. Ask the CPA firm which populations and samples it will draw so your team knows which records to keep. The AICPA SOC 2 guide describes how Type 2 examinations are structured.

How do the proposed 2026 attestation changes affect our current SOC 2 work?

The AICPA Auditing Standards Board exposed proposed revisions to AT-C 105, AT-C 205 and AT-C 210 in February 2026. If adopted, the updates would apply to engagements beginning on or after June 15, 2029, so they should not change an engagement that starts before that date. The proposals are still in exposure, so their final wording is not settled. For current work, the practical step is to keep your representation letter, assertion and evidence practices sound under today's standards and to ask your CPA firm how it plans to handle any future changes. Review the Journal of Accountancy's February 2026 report and confirm the status with your auditor before relying on either version.

What should a written scope for a SOC 2 audit include before signing?

A written scope should state the system, services, locations and infrastructure in the report, the Trust Services Criteria categories added to security, and whether the report is Type 1 or Type 2 with the period covered. It should also name the subservice organizations, whether they are included or carved out, and the deliverables, such as the management assertion, system description and report. Ask for the responsibilities of each party, the evidence and sampling expectations, the timeline milestones and the fee structure with what is included and what triggers additional charges. For implementation work, a fixed-scope written agreement with defined deliverables and dates is the standard to ask for. Cost drivers are covered on the SOC 2 cost page and timing on the SOC 2 timeline page.

Who is responsible if the auditor finds an exception in our controls?

Your organization is responsible for its controls and for the exception, and the CPA firm reports what it found in the service auditor's report and tests of controls. An exception does not automatically make a report unusable, but how it is described matters to customers. Your team should investigate the root cause, document the correction and show evidence that the control now operates. An implementation partner can help remediate and produce evidence, but the decision on how to describe the exception belongs to management and the auditor. Ask the CPA firm early how it communicates exceptions so they are not a surprise at report issuance.

How DeployOpen prepares systems and evidence for your SOC 2 examination

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure so the controls and evidence an examination depends on are in place before the CPA firm arrives. Your organization owns its controls and its management assertion, and only the independent CPA firm issues the report.

How we scope

We agree the systems, services and locations to be covered in a written scope before work starts.
Scope and deliverables are fixed in writing, so you know what is included before any work begins.
We map the platforms we build to the Trust Services Criteria your scope selects, with your CPA firm's input.

How we build

We implement and harden self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
We configure access control, logging, change workflows and backups so each control produces a record an assessor can sample.
We document the system components and control activities that management needs for its system description.

How we hand over

You receive written deliverables covering configuration baselines, control documentation and the evidence collection procedure.
Runbooks and evidence locations are documented so your own staff can run the controls after handover.
We walk your team through the evidence and testing prepared for the examination, and confirm what your auditor will request.

How we support

Ongoing support, upgrades and continuous security testing are available as a retainer after the initial engagement.
A retainer can keep platforms patched and evidence current between examination periods for a Type 2 observation window.
Confirm with your CPA firm which preparation tasks it expects from you versus from an implementation partner before scope is signed.