NDNB has developed an in-depth SOC 2 roadmap to compliance for businesses seeking to gain a stronger understanding of the entire SOC auditing lifecycle. Knowing the steps and related activities to undertake from beginning to end in regards to SOC 2 compliance is highly essential for ensuring an audit that’s efficient, completed on time, and within budget. Are you a technology company in North America and have been asked to perform an annual SOC 2 Type 1 and/or SOC 2 Type 2 audit, if so, now’s the time to gain a greater understanding of all the essential elements of the AICPA Service Organization Control (SOC) reporting platform.

NDNB also offers comprehensive SOC 1 and SOC 2 audits for businesses using Amazon AWS, Microsoft Azure, and Google GCP. 

Using AWS for Hosting? Here's What You Need to Know about Performing a SOC 2 Audit when Using AWS

8 Things to Know about SOC 2 Audit Reports for Service Organizations

NDNB has performed literally hundreds of SOC 1 and SOC 2 audits for businesses all throughout North America, so take note of the following essential subject matter regarding for SOC 2 auditing success:

1. Scoping & Readiness Assessment:

Being prepared for a SOC 2 audit means starting with a comprehensive readiness assessment that takes examines a service organization’s internal control environment – its information security and operational specific procedures and processes. Almost every company will find that some type of remediation is necessary for optimizing their control environment for ensuring satisfactory audit findings – just how much remediation depends on the maturity of one’s control environment itself.

2. Business Process:

What is the actual scope for the SOC 2 assessment – more specifically – are you covering your entire service offerings or just a specific category? This is important to determine early on as you don’t want scope creep settling in during any time of the audit. Communicating with clients and internal personnel as to what one can expect in terms of audit scope helps identify essential operational commitments from your internal resources. To learn more about important business process scope considerations, call and speak with CPA Christopher Nickell at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it..

3. Choosing the relevant Trust Services Criteria (TSP):

With five (5) TSP’s to choose from, businesses will need to make sure they’ve included the correct Trust Services Criteria within the scope of the audit. While almost every service organization assesses against the “Security” TSP, after that, you’ll need to determine the applicability of the remaining four (4). We’ve even had some company’s request an assessment for a single TSP other than the “Security” TSP – which is rare – but it does happen. Speaking with North America’s leading SOC 2 firm will give you the insight and guidance needed on this important issue.

Also, keep in mind that because the actual AICPA SOC reporting platform has a high degree of flexibility in place in terms of actual scoping parameters and tests of controls, you can expect to see clear differences in terms of a final deliverable from one SOC 2 report when compared to another. For example, a SOC 2 report performed on a data center will differ in various areas when compared to a SOC 2 report done on a cloud computing company.

Also, a SOC reports issued from CPA firms will often differ, even when performed on a similar type of business, again, it has to do with the large degree of flexibility within the AICPA SOC reporting platform; so, keep this in mind. It’s therefore important to choose a firm with years of experience performing SOC 2 audits in almost every possible industry, and that’s exactly the expertise that NDNB offers, so call and speak with Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

4. Remediation:

Correcting internal control deficiencies relating to one’s information security and operational posture can take some time, and it’s why many businesses prefer not to begin an actual SOC 2 assessment immediately – rather – take the time to correct control weaknesses.

While developing security documentation is essential for SOC 2 compliance, remember that the actual procedures need to be implemented and followed for ensuring one’s internal controls are functioning as performed. For example, you may very well have developed numerous information security documents – such as access control, change control, patch management, incident response, and others – and that’s great, but have the procedures been implemented, and are they being followed.

Documentation is critical – make no mistake about it – but so are the actions and initiatives taken for ensuring they’re being followed. Remember, auditors will ask for documents as audit evidence, but they’ll also test the procedures for ensuring they’re functioning as described.

5. The Importance of Assessing Risk:

Every business, regardless of regulatory compliance, should make a practice of assessing risk, as it just makes good business sense. Knowing the risks and threats affecting your organization is also a mandate for SOC 2 compliance as a number of the “Common Criteria” tests call for comprehensive measures relating to the broader aspect of risk management. As with many other areas within the SOC 2 framework, NDNB offers industry leading risk assessment documentation for helping meet SOC 2 compliance, but also putting in place adequate risk management initiatives.

6. Security Awareness Training:

Now a prescriptive mandate for SOC 2 compliance, training employees on critical security topics, issues, and threat is a good idea, particularly in today’s world of growing cybersecurity threats and challenges. Many auditors will often include security awareness training as part of the scope for a SOC 2 assessment, effectively placing it under one of the many “common criteria” categories. And if you think about it, isn’t is a best practice that you should be performing annually anyway? It is.

7. Audit Evidence:

Keep in mind that was officially makes an audit an “audit’ is the large amounts of evidence that must be collected by the auditors. From documentation to screenshots, log reports, signed memos, physical inspection – and more – it can be a time-consuming task, and it’s why having a clear understanding of what’s being asked for is important for the overall success of the SOC 2 audit. NDNB provides an easy-to-use follow list of deliverables for helping ensure clarity and transparency throughout the audit process from day one.

8. The Final Report:

A SOC 2 report is a service auditor’s findings of a service organization’s control environment and is often a lengthy document that consists of the “description of the system”, along with the “written statement of assertion”, and other necessary report material. The CPA firm performing the SOC 2 assessment will no doubt author the vast majority of the report, but will need input from you in helping develop language for specific sections.

SOC 2 Compliance Experts – Fixed Fee Pricing

NDNB has been North America’s leading provider of SOC 2 Type 1 and SOC 2 Type 2 assessments for years, offering fixed-fee pricing, along with high-quality services. We also provide numerous supporting tools helping ensure an efficient and comprehensive audit process from day one. Today’s compliance mandates can be challenging, time-consuming and highly complex, so turn to North America’s trusted CPA and advisory firm for all your needs – NDNB.

Call and speak with Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today. We hope you found the SOC 2 audit report roadmap to compliance helpful, so please don’t hesitate to reach out to us if you have any other questions, comments, or concerns.