What does a SOC 2 audit actually involve?
March 6, 20262 min readSOC 2 Basics for Founders
What Happens During a SOC 2 Audit?
A SOC 2 audit is a structured examination by a licensed CPA firm. The auditor tests whether your security controls are properly designed (Type I) or operating effectively over time (Type II). It is not a penetration test or vulnerability scan — it is a controls-based assessment.
The Audit Process Step by Step
- Scoping — You and the auditor agree on which Trust Services Criteria are in scope, which systems are included, and the audit period (for Type II)
- Control documentation — You provide a list of your controls mapped to the applicable criteria, often called a controls matrix
- Evidence collection — You gather artifacts proving each control is in place: screenshots, configuration exports, policy documents, access logs, and process records
- Walkthrough meetings — The auditor conducts interviews and walkthroughs to understand how each control works in practice. Expect 2–5 meetings depending on scope
- Testing — The auditor independently tests your controls by reviewing evidence, sampling records, and verifying configurations
- Remediation (if needed) — If the auditor finds gaps, you have a chance to fix them before the report is finalized
- Report issuance — The auditor delivers the final SOC 2 report with their opinion
What Does the Auditor Actually Look At?
| Control Area | What Auditors Test | Evidence Examples |
|---|---|---|
| Access control | Who has access, how it is granted and revoked | IAM screenshots, access review records |
| Change management | How code and infrastructure changes are tracked | Git logs, PR approvals, deployment records |
| Risk assessment | Whether you identify and manage risks | Risk register, risk assessment documents |
| Monitoring | How you detect and respond to issues | Alert configurations, incident tickets |
| Vendor management | How you evaluate third-party risk | Vendor assessments, contracts |
| Encryption | Data protection in transit and at rest | TLS configs, encryption settings |
How Long Does the Audit Take?
The actual audit fieldwork — from first evidence request to report delivery — typically takes 3–6 weeks for Type I and 4–8 weeks for Type II. Preparation before fieldwork is where most time is spent. Screenata handles evidence collection and control documentation before your auditor begins, so fieldwork moves faster.