What to outsource for SOC 2 and what you must keep in-house
Management owns the controls and the decisions behind them, and that accountability cannot be outsourced. A partner can help design, build, document and monitor controls and assemble the evidence that shows they operate, but your leadership still decides which risks matter, which controls answer them, who is accountable for each one and whether the system description is accurate. Only an independent CPA firm can examine those controls and issue a SOC 2 report. Keep the split clear from the start: the organization owns its controls, an implementation partner prepares systems and evidence, and the CPA firm tests and reports. The right division depends on your scope, headcount and existing tooling, so the first task is to write down who performs and who approves each control. In practice, the work that must stay in-house includes approving the security and access policies, deciding risk treatment in the risk assessment (CC3), accepting exceptions, owning vendor risk decisions under CC9.2, and signing the management assertion and representation letter that the examination requires under AT-C section 205. Your team also has to be able to explain the controls, because the auditor will ask staff and not only the partner. Ask any partner to show, in writing, which control tasks it performs, which it only drafts and which remain with your named owners. A partner that cannot give that list is a risk in itself.
Work that partners commonly take on includes writing control narratives, configuring logging and access reviews, building evidence collection routines, drafting policies for your review, monitoring controls between audits and preparing the control matrix. Many of these tasks recur. Ask what each one costs in effort for the first cycle and what it costs to keep running, and whether the partner's deliverables transfer to your own tools. Tooling can reduce manual evidence work, but as the Journal of Accountancy noted in February 2026, many newer SOC tool providers are not CPA firms and cannot attest that controls are effective. Choose tools for what they record, not for promised compliance. Keeping the auditor independent is the final check. The AICPA Code requires an attest client to designate a suitable individual to oversee nonattest services, evaluate their results and accept responsibility for them. If the CPA firm builds controls for you, its independence may be threatened, so confirm before work starts that your partner and the auditor have agreed roles in writing. Confirm this with your auditor, not only with your partner.
Who does what: your team, the partner, the tools and the CPA firm
Your organization owns its controls, its system description and its management assertion. Management decides which risks matter, which controls answer them, who is accountable for each control and whether the controls operate as designed. A partner can draft and build, but the people who run the business must be able to explain the controls, approve them and act on exceptions. Under the 2018 description criteria, the system description is management's document, so management must be able to stand behind it.
- Accountability for risk: Management decides risk tolerance and signs off on the risk assessment that the CC3 criteria expect.
- Named control owners: Each control needs an owner who reviews its results and answers auditor questions.
- Policy approval: Leaders approve the policies and records that the auditor will test.
- Representations: Management signs the written representations the examination requires, so these statements cannot be delegated away.
- Ongoing operation: Access reviews, incident response and vendor reviews happen only if your staff runs them.
Before you engage anyone, confirm which person on your side owns each control and can answer for it in fieldwork.
An implementation partner can prepare systems, controls and evidence, and it can take on delivery work that your team lacks capacity or expertise to complete. It does not issue a report or an opinion. Partners commonly take on control implementation, evidence collection, gap assessment and monitoring between audits, all within a written scope. Their work product becomes an input to your management's controls, and your team must review and adopt it.
- Control implementation: Configuring logging, access workflows and change controls in your environment.
- Evidence collection: Building repeatable ways to capture the records the auditor will sample.
- Gap assessment: Comparing current controls against the criteria and listing what is missing.
- Monitoring between audits: Checking that controls keep operating after the examination period starts.
- Documentation: Drafting policies and procedures that your team then approves.
Independence boundary: the partner should not select the auditor's samples, decide what the auditor concludes, or sign the management assertion on your behalf. Ask for a written scope that lists deliverables and states who owns each one.
Tools collect evidence, track tasks and automate checks, but a tool does not make a control effective. Cloud providers publish their own SOC reports for their infrastructure, yet the shared responsibility model keeps the customer accountable for much of its own security. The AWS shared responsibility model makes AWS responsible for security of the cloud, the hardware, software, networking and facilities that run its services. The customer's responsibility for security in the cloud depends on the services it uses. On Amazon EC2, for example, the customer manages the guest operating system, patches, installed applications and security group configuration.
- Provider scope: Inherit provider controls only for the services and regions your report covers, and confirm the boundary yourself.
- Customer configuration: Security group rules, IAM policies and patch cadence remain your controls on EC2.
- Evidence generation: Tools can export logs and access lists, but someone must define the sample and review the output.
- Tool claims: Be wary of vendors promising fast or guaranteed compliance, since SOC 2 examinations do not use that term and tools cannot attest to effectiveness.
- Data handling: Know where evidence is stored and who can change it.
Ask each tool vendor which of your controls it actually supports and which still require a human decision.
The CPA firm performs the examination and issues the report. Its role is independent attestation: it tests the controls you describe, selects samples, evaluates exceptions and forms an opinion. The firm's independence is what gives the report value to your customers. A firm may provide some nonattest services, but the AICPA Code requires the attest client to assume management responsibilities, designate a competent individual to oversee the service and accept responsibility for the results. The firm must not design or operate the controls it will later test.
- Examination work: Walkthroughs, sample testing, and the opinion on design or operating effectiveness.
- Independent judgment: The firm sets its own scope of testing and its own fee, based on its professional judgment.
- Nonattest limits: Readiness help from the firm must be assessed against the Code before you accept it.
- Referral and tool arrangements: Undisclosed referral or bundled tool deals can threaten independence.
- Report ownership: The report is issued by the firm, not by your consultant or your tool vendor.
Before engaging the firm, ask in writing which services it will provide beyond the examination and how it will document independence.
Work partners commonly take on, and what to keep
Partners usually take on the build and collection work that a SOC 2 demands at volume. Management still owns the decisions, approvals and day-to-day operation that the auditor will test and hold the organization accountable for.
Control implementation on infrastructure
A partner can configure identity providers, logging, encryption, backups and access controls in your cloud accounts and write the infrastructure as code that deploys them. Management must still approve each control design, decide who owns it after handover, and operate it. On AWS, the customer still manages guest operating systems, patching and security group configuration on EC2, so confirm in writing which of those tasks the partner performs and which stay with your staff.
Evidence collection and organization
A partner can set up automated evidence capture, name and file records by control and period, and build the folders the auditor will request. The organization still has to generate real records, such as completed access reviews and approved changes, and confirm that the captured evidence is complete. Ask the partner who can answer auditor questions about where each artifact came from.
Monitoring between audits
A partner can set up alerts, recurring control checks and dashboards that flag drift between audit periods. Monitoring only helps if someone reviews the alerts, decides what counts as a deficiency and records the follow-up. Management must own that review cycle, including who receives alerts out of hours and how exceptions are escalated.
Policy drafting
A partner can draft policy templates that match your systems and the criteria in scope. Adoption is a management act: leaders must review the text, approve it, communicate it to staff and enforce it. A policy that describes controls you do not run will generate exceptions, so the wording must match how the environment actually operates.
Control matrix and system description drafting
A partner can draft the control matrix and the system description against the AICPA description criteria, mapping each control to the criteria it addresses. Management remains responsible for the description and the assertion built on it. Management must confirm every boundary, service, subservice organization and complementary user entity control, because those statements are what the auditor tests.
Readiness assessments
A partner can run a gap assessment that compares current controls with the criteria and produces a remediation list with owners. The partner's findings are advice, not an audit conclusion. Management must decide which gaps to fix, accept or defer, and must confirm the readiness results. Readiness work must stay separate from the examination itself so the CPA firm remains independent.
Keeping the auditor independent when a partner prepares you
The line that matters is between preparing and attesting. Your implementation partner can design controls, document procedures, configure systems and organize evidence, but the CPA firm must test those controls and issue the report. The partner prepares, the CPA firm tests and reports, and management keeps ownership of both. Under the AICPA Code's general requirements for nonattest services, the attest client must agree to assume management responsibilities, designate an individual with suitable skill, knowledge or experience to oversee the work, evaluate its adequacy and results, and accept responsibility for those results. If your team cannot do that, the arrangement starts to threaten the auditor's independence before fieldwork begins.
Bundles and referrals are where independence most often breaks down. A SOC tool provider that sells software, readiness work and an audit as one package may set or change the fee for the examination, which AICPA ethics staff wrote in April 2026 must rest on the service auditor's professional judgment. Ask the CPA firm whether it has a referral, revenue or tool arrangement with any partner you are considering, and whether the fee for its examination is set independently of any package price. Also note the February 2026 warning from the Journal of Accountancy that most SOC tool vendors are not CPA firms and therefore cannot attest that controls are effective. A vendor's promise of a fast or guaranteed result is a reason to slow down, not speed up, because only the examining firm can issue the opinion.
Before you sign with a partner, ask the CPA firm in writing which preparation work it will accept from others, which it will not perform itself, and whether it will review a partner's control descriptions or evidence without that review counting as a test. Confirm the answers with the firm rather than assuming them from the partner's marketing. Then record in your own files who owns each control, who approved the partner's deliverables and who signs the management representations. Those records are what an examiner will ask for when independence is questioned.
How to agree the split before work starts
This sequence turns a general idea of who does what into a written split that names an owner for every criterion, the evidence each owner produces, and the limits on what the auditor can accept. The result is a record that your team, your partner and the CPA firm can all check before fieldwork begins.
Map each criterion to a named owner
List the criteria in scope, starting with the common criteria CC1 to CC9 and adding A1, C1, PI1 or P1 to P8 only if those categories are in scope. For each criterion, name one accountable person inside your organization, even when a partner or tool performs the work. Your team confirms each owner in a shared matrix. The step is complete when no criterion in scope has a blank owner field.
Classify each task as retained, shared or delegated
For every control activity under each criterion, mark whether management keeps it (approving policies, accepting risk, deciding exceptions), whether it is shared (for example, drafting a procedure that management then approves), or whether it is delegated to a partner or tool. Tasks that carry a management decision stay retained. The output is a classified task list that shows which work would leave your building and which would not.
Agree the split in writing
Put the classified matrix into a statement of work or a responsibility schedule signed by both parties. The document should state what the partner delivers, what your staff must provide, and which items remain your responsibility even if the partner drafts them. Ask for the partner's written scope before work starts. The step is complete when both signatories hold the same version of the schedule.
Confirm the CPA firm's position on prepared work
Ask the CPA firm in writing which readiness work it will accept as management-prepared, which it will review, and which it considers a nonattest service that would affect its independence. Its answer determines how the split can be drawn. Record the reply in the file. The step is complete when the firm's position is documented and your schedule matches it.
Set evidence ownership and retention
Decide where each evidence type lives (ticketing, identity provider, cloud logs, HR system), who exports it, how often, and who reviews it before it reaches the auditor. Assign evidence ownership to your own staff for records that management must be able to stand behind, including access reviews and approvals. The output is an evidence register with an owner and storage location for each item.
Record decisions and the management responsibilities
Write a decision log that captures each agreed split, the reason for it, and the manager who accepted it. Include the designated individual who oversees the partner's work and who must evaluate its results. The log shows an assessor that management, not the partner, made the decisions. The step is complete when the log is approved by the accountable executive and stored with the SOC 2 file.
Review the split when scope changes
Revisit the matrix and the decision log when the system boundary, a subservice organization, a cloud platform or the TSC categories in scope change. Confirm again with the CPA firm whether a change alters its independence position. The output is a dated revision of the schedule and log, so that the split in force during the observation period can be shown to the auditor.
Where outsourcing goes wrong and how to avoid it
Outsourcing SOC 2 work moves effort, not accountability. The failures below share one root cause: the organization stops understanding or controlling the systems and records that the auditor will test. Each card names a risk and the check that keeps the work in your hands.
Handing accountability to a partner
Management keeps responsibility for the system, its controls and the assertion, even when a partner builds them. The AICPA Code's nonattest rules expect the client to designate an individual with suitable skill to oversee the work, evaluate its results and accept responsibility for them. Before work starts, name an internal owner for each control area and confirm in writing who signs off on each deliverable. Check that the owner can explain every control without the partner in the room.
Tool vendors promising compliance
Some SOC tool vendors promise compliance in weeks or even hours. SOC 2 examinations do not use the term compliance, and most of these tool providers are not CPA firms, so they cannot attest that controls are effective. Treat any promise of a fast pass as a warning sign. Ask the vendor which control objectives its product covers, which parts still depend on your own procedures, and whether the CPA firm has accepted the tool's evidence.
Controls the team cannot operate
A partner may design controls that look complete on paper but require steps nobody on your team performs. A Type 2 report tests operating effectiveness over a period, so an access review that only the consultant runs will show gaps once the consultant leaves. Before accepting a control design, have the people who will run it walk through a sample cycle. Confirm each control has a named operator, a schedule and a place where its records are kept.
Evidence stored outside your control
When a partner's platform or folder holds the screenshots, tickets and logs the auditor will sample, your access to that evidence depends on their contract. If the relationship ends, or the auditor needs records quickly, the report can be delayed. Keep primary evidence in systems your organization administers, and give your team read access to any partner-hosted copy. Write down how long records are retained and who can export them.
Unclear limits on prepared work
The CPA firm that issues the report must stay independent of the work it tests. If the firm also builds controls or writes policies, the scope of that help needs to be explicit and within the Code's limits. Ask the CPA firm, before engagement, which tasks it can perform, which must be done by your team or a third party, and how it will document its reliance on prepared material. Get those limits into the engagement terms.
Frequently asked questions about outsourcing SOC 2
Can we outsource our SOC 2 entirely to a partner or consultant?
No. You can outsource a large share of the preparation work, but you cannot outsource responsibility for the controls. Management owns the system description, the risk decisions, the policies it approves and the assertion it makes to the auditor. A partner can build systems, configure tools, draft procedures and assemble evidence, but the organization must operate the controls day to day and be able to explain them. The CPA firm then tests that work independently and issues the report. Only the CPA firm can issue a SOC 2 report, so no partner can deliver the report itself. Ask any partner to state in writing which tasks it performs and which remain with your staff.
Which SOC 2 work must our own team do itself?
Your team must hold the decisions and perform the recurring operations. Concretely, that means naming an accountable owner for each control area, approving policies, deciding which risks to accept, approving access requests and reviews, running change approvals, responding to security events, and managing vendors. Your staff should also be able to answer the auditor's questions about how each control works and show that it operated during the observation period. Partners can prepare these processes, but a control that only the partner understands will fail when the partner leaves. Plan for internal staff to own the controls from the first day of the readiness work.
How much internal effort does a SOC 2 require?
The effort depends mainly on how much of your environment is already documented and automated, how many systems fall within scope, and whether you need a Type 1 report first or go directly to a Type 2 observation period. Effort rises with the number of in-scope services, the number of cloud accounts, the number of people who need access, the number of vendors that touch customer data, and the amount of manual evidence collection. It falls when access, change and logging controls already produce records automatically. Ask your partner and your CPA firm to estimate the internal hours by control area in the written scope, and ask which recurring tasks continue after the first report. No effort figure is set by the standard, so treat any single number as an estimate that depends on your environment.
Can the CPA firm that audits us also prepare us for SOC 2?
Sometimes, but it creates an independence question you must resolve before engagement. Under the AICPA Code, a firm that performs nonattest services for an attest client must meet specific conditions, including that the client assumes all management responsibilities, designates a qualified individual to oversee the work, evaluates the results and accepts responsibility for them. If the same firm designs controls and then tests them, the firm may face a self-review threat. Many organizations therefore use one firm for readiness and a different firm for the examination. Read the AICPA SOC 2 topic page and ask the CPA firm to confirm its independence position in writing.
What should a SOC 2 implementation partner hand over at the end?
A good handover gives your team the ability to run the program without the partner. Ask for the system description inputs, the control matrix mapping each criterion to a control, the policies and procedures in editable form, configuration records and infrastructure code, the evidence collection process with the location of each artifact, a list of open gaps and owners, and a runbook for recurring reviews such as access reviews, vendor reviews and vulnerability tracking. The partner should also train named staff on how each control works and what the auditor will ask. Confirm the deliverables, their formats and the acceptance criteria in the written scope before work starts.
How do we confirm the split of work is acceptable to the CPA firm?
Ask the CPA firm before work starts, and record the answer. Share a draft responsibility split that lists each control area, the internal owner, the partner's role and any tool that produces evidence. Ask the firm whether it accepts that division, which evidence it expects to receive, and whether any preparation work would affect its independence. Confirm who sets the fee for the examination and whether any tool or partner bundle changes it. Review the CPA firm's engagement letter for terms that restrict evidence sharing or communication with your partner. The AICPA's SOC 2 Reporting guide describes what management must provide to the examination.
How DeployOpen scopes the split and prepares your evidence
DeployOpen works on the split between your team, an implementation partner, your tools and the CPA firm by agreeing the boundary in writing before work starts. We prepare systems, controls and evidence in your own infrastructure, while your organization keeps ownership of its controls and the independent CPA firm alone issues the SOC 2 report.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- The written scope lists which controls and evidence we prepare and which ones your team or the CPA firm keeps.
- Each responsibility is assigned to a named owner on your side so accountability stays with management.
How we build
- We implement and configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
- We document each control, its owner and the evidence it produces so the control matrix maps to your system.
- We test the controls we build, including applications, APIs and infrastructure, and record the results for your team to review.
How we hand over
- You receive the documentation, configurations and evidence records in a form your team can run without us.
- Your team takes over operating each control, with the handover agreed in the written scope.
- The CPA firm receives evidence through the channels you choose, and any sampling or testing decisions remain with the auditor.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the handover.
- Retainers can cover monitoring between audit periods, so evidence keeps flowing for a Type 2 observation window.
- Confirm with the CPA firm which support activities it considers acceptable before you sign any retainer.
