SOC 2 readiness timeline
The work sequence that should happen before a Type I or Type II examination.
Phase 1: define the report objective
Start with the customer need, target date, service boundary, intended report type and Trust Services Criteria. Security is always included; other categories should be selected because commitments and risks require them, not because more appears better.
Document products, infrastructure, people, locations, data, vendors and complementary user-entity controls. Unclear boundaries create control gaps and evidence requests later.
Phase 2: design controls around risks
Map system risks and customer commitments to control activities. Each control needs an owner, frequency, reviewer, evidence output, population and exception path.
Do not begin by buying a policy bundle. Policies should describe the operating model that engineering, HR, IT and operations can actually perform.
Phase 3: operate and collect evidence
Run the controls on their planned cadence. Preserve complete populations where sampling may be required: changes, users, vendors, incidents, vulnerabilities and access reviews.
For Type II, operating evidence must cover the defined period. A late control redesign can leave too little time to demonstrate consistent operation. Discuss timing with the selected CPA firm.
Phase 4: remediate exceptions
Test samples before the auditor does. Record missing approvals, late reviews, inconsistent populations and unsupported exceptions. Fix root causes and preserve closure evidence.
Automation can reduce collection effort, but it does not replace precise control design, owner accountability or the auditor’s independent judgment.
Phase 5: hand off cleanly
Prepare the system description inputs, control matrix, evidence index, exception log and owner directory. Keep advisory work distinct from the independent CPA examination.
A readiness adviser can improve preparation, but only a licensed CPA firm can perform the SOC examination and issue the report.