Looking to learn about the SOC 2 audit process from beginning to end? A simple, yet comprehensive and easy-to-understand process on what it takes to become SOC 2 compliant for your organization? NDNB, one of North America’s leading providers of SOC 1 and SOC 2 audits offers the following A to Z explanation of the SOC 2 audit process.

Step 1: Understand Exactly what SOC 2 is.

Ask any number of professionals what SOC 2 is and you’ll probably get quite a few different answers. Some answers we hear are the following:

• It’s an audit
• It’s a certification
• It’s a best practice for operations and information security
• It’s a checklist that can be quickly completed

In simple terms – as simple as we can make it – System and Organization Controls (SOC) 2 is a comprehensive reporting framework put forth by the American Institute of Certified Public Accountants (AICPA) in which independent, third-party auditors (i.e., CPA’s) perform an assessment and subsequent testing of controls relating to the Trust Services Criteria of Security, Availability, Processing Integrity, Confidentiality and/or Privacy.

There are two (2) types of SOC reports – SOC 2 Type 1 and SOC 2 Type 2, and this is important to know. A SOC 2 Type 1 report is a report on management’s description of a service organization’s system and the suitability of the design of controls. A SOC 2 Type 2 report is a report on management’s description of a service organization’s system and the suitability of the design and operating effectiveness of controls. So, what’s the real difference between the two (2) reports. Simply stated, a SOC 2 Type 1 assesses controls for a point in time, while SOC 2 Type 2 assesses and also tests controls for a stated period of time – usually anywhere from six (6) to twelve (12) months.

Step 2: Begin with a SOC 2 Scoping & Readiness Assessment

Have you been through a SOC 2 audit before? Curious as to what the actual audit process entails? The importance of a SOC 2 scoping & readiness cannot be overstated when it comes to defining scope, identifying critical gaps & control deficiencies, putting together a cohesive plan-of-action, and more. Even for service organizations who’ve undergone previous SOC 2 audits, a scoping & readiness assessment is often essential for helping re-group key personal and re-focusing on core elements of the audit. Here are a few of the many benefits of why you should be performing a SOC 2 scoping & readiness assessment prior to the commencement of the audit:

• Helps in identifying scope in terms of business processes, systems to test, physical locations to inspect, personnel to be included in the audit, and more.
• Ensures a proper assessment and identification of control gaps and what steps need to be taken for correcting such deficiencies.
• Allows your organization to put in place a true roadmap for compliance, one complete with deliverables, tasks to be performed, and more.
• In the end, a SOC 2 scoping & readiness assessment is an invaluable exercise for adequately preparing your organization for the road ahead in terms of SOC 2 compliance.

Step 3: Remediate Gaps in Documentation

As auditors, we’re often asked what’s the most demanding, challenging, and time-consuming aspect of becoming SOC 2 compliant. That’s actually an easy answer – documentation. More specifically, the need for developing comprehensive information security policies and procedures for the many requirements within the SOC 2 framework. Why is it such a challenge? First, most organizations don’t have the staff on board to author the policies. Second, most organizations also find that their existing policies are completely inadequate for today’s growing compliance needs. Third, finding time to author policies and procedures is so taxing that most organizations simply give up before they even consider starting. Fourth, finding high-quality templates can be a challenge in of itself.

Here's just a small sample of the InfoSec policies you’ll need for SOC 2 compliance:

• Access control policies and procedures
• Change management/change control policies and procedures
• Data backup policies and procedures
• Incident response policies and procedures
• Usage policies and procedures
• And much more.

Remember also that the SOC 2 framework is also heavily dependent upon organizations having in place various formalized processes around operations – which, once again – requires more documentation. We can assist; contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706 to learn more, or email him directly at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

Even with all that said (and that’s a lot!), developing documentation is an absolute key element of being SOC 2 compliant. The solution? Let NDNB provide you with industry leading templates – or even better – let NDNB author the documents for you. Whichever route you take, it all leads back to the same requirement; documentation has to be developed. As to the types of policies and procedures – think change management, data backup, access control, incident response, and much more. We can help, contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706 to learn more, or email him directly at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

Remediating documentation is often a very time-consuming process, so consider hiring an expert CPA firm with years of experience in writing information security policies and procedures for SOC 2 compliance, and that’s NDNB. Focus on what you’re good at – and that’s running your business – and we’ll focus on getting you through your annual compliance requirements. From SOC 1 and SOC 2 reporting to GDPR, HIPAA, PCI DSS, FISMA and more – we have the expertise, manpower and business knowledge to get you across the compliance finish line – all within a reasonable timeframe and budget!

Step 4: Remediate Operational and Technical/Security Gaps

Just as important as developing documentation is correcting operational and technical/security gaps within ones’ control environment. From an operational perspective, you’ll need to ensure that you’ve tested your incident response plan, rolled out security awareness training to employees, conducted a comprehensive risk assessment, and more.

From a technical/operational perspective, you’ll need to ensure that information systems have been configured with best practices, that all necessary security tools/solutions (i.e. Two-factor authentication, File Integrity Monitoring, etc.) have been put in place. The SOC 2 standard is now constantly evolving – similar to other compliance frameworks – so keeping current is essential for security best practices, but also for obtaining a clean opinion on your annual SOC 2 audit itself.

Keep in mind that remediation is often the most time-consuming and tedious aspect of any SOC 2 compliance efforts, especially for service organizations new to such reporting. Remediating all the deficiencies in year one makes subsequent SOC 2 reporting that much easier.

Step 5: Do a “Dry Run” for Testing Controls

As a CPA firm that’s issued hundreds of SOC 1 and SOC 2 audit reports for businesses all throughout North America, here’s one thing we can say that definitely should be done – do a “dry run” before the auditors arrive. What’s a “dry run”? It’s essentially where your organization performs the actual audit to determine if any gaps or issues exist prior to the auditor coming on-site. A clean bill of health on a “dry run” is good news, as it likely means you’ll have a good experience with the auditors. At the same time, any issues found allow you to immediately correct the gaps before the auditors arrive. In the end, such a task will save you time, money, and the headaches of having to stop an audit mid-stream to correct a control deficiency.

Step 6: Bring in the Auditors

Was your “dry run” successful? Great, then bring in the CPA firm that you hired to perform the actual audit and let the process begin! Here are some helpful tips and recommendations when working with SOC 2 auditors:

• Be open and transparent at all times.
• Provide all requests to the auditors, as this just ensures a smooth an efficient process.
• If disagreements surface, work them out by consensus and don’t become argumentative with one another.

Step 7: Monitor your Controls on a Regular Basis

Auditors that perform annual SOC 2 Type 1 and SOC 2 Type 2 reports for organizations are really only “deep in the trenches” a few weeks a year when it comes to your business. It’s not their responsibility to monitor your controls annually, rather, it’s your responsibility. This means that it’s time to develop a game plan for monitoring internal controls on a regular basis. Here are some helpful tips when developing a monitoring platform for internal controls:

• Identify internal personnel who have the appropriate skillsets for such a task.
• Documentation is important, so develop a set of checklists for helping monitor and assess internal controls.
• Reporting is essential, so ensure you have a plan for reporting upstream to management the findings.
• Action is imperative, so if control weaknesses are found, then changes and modifications need to be undertaken – and immediately.

Monitoring internal control is such a fundamental task for one’s overall SOC 2 audit process, so please keep this in mind. Contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706 to learn more, or email him directly at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

Step 8: Repeat Each Year

The SOC 2 audit process is an annual requirement, so keep this in mind. Therefore, it’s important to source a high-quality CPA firm that you can work with for years to come. Entering into a multi-year engagement for both the service provider (that’s you!) and the CPA firm in terms of SOC 2 compliance has many obvious benefits. You should receive favorable pricing, develop continuity with each other, and more. The regulatory compliance landscape has shifted tremendously in recent years, requiring tens of thousands of service providers throughout North America to undergo annual SOC 2 compliance.

You need to work with a firm that can provide the necessary guidance, expertise – and value – and that’s NDNB. We can help, contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706 to learn more, or email him directly at This email address is being protected from spambots. You need JavaScript enabled to view it. today. NDNB also offers comprehensive services for PCI DSS compliance, FISMA and DFARS NIST 800-171 compliance, GDPR, and much more.

Why NDNB

We are one of North America’s leading providers of fixed-fee SOC 1 and SOC 2 audit reports. We’ve been working with companies all throughout North America for years, offering proven services and fixed-fees. No, were not the biggest CPA firm in town, just one of the best, and proud to say that. Compliance doesn’t have to a lengthy and expensive proposition each year, and with NDNB its’ not. Let’s talk about your compliance needs today so you can learn more about the SOC 2 audit process from proven, trusted experts.