How do we get ready for a SOC 2 examination: owners, evidence and a readiness check?

Start

We want to be ready before the SOC 2 observation period starts

Readiness is management's own check of the system, the controls and the evidence before the observation period starts. It is not the auditor's work and not an opinion. Its job is to find the gaps while there is still time to close them, and to decide on stated grounds when the period should begin.

• Then: Are the report type, categories and boundary agreed?

Decision

Are the report type, categories and boundary agreed?

The procedure assumes that the scope has been discussed and a description is being drafted. The categories decide whether some readiness items apply, and the boundary decides what every control and the whole report are about. If you are not sure, answer no.

• Yes: List the controls you rely on, criterion by criterion
• No, or not known: Settle the scope first, then come back

Outcome

Settle the scope first, then come back

Settle the boundary first, because everything else depends on it. Then settle the report type and the categories, and write down why the scope is what it is. Return here when the scoping result and a draft description exist.

Step

List the controls you rely on, criterion by criterion

For each criterion in scope, write down the control or controls you rely on, in your own words and by the IDs in your control inventory. The register is a list, not a mapping. The pairing is your own judgement, and the register makes no claim that a control meets a criterion.

• Then: Does every control have one named owner and a written statement?

Decision

Does every control have one named owner and a written statement?

Every control the examination will test has one named owner, a written statement of what is done and how often, and a record the work leaves as a by-product. The owner performs the control as written, keeps the record and answers the auditor's requests for that evidence.

• Yes: Decide the record, its system and how long it is kept
• No, or not known: Name one owner for each control and write what it does

Step

Name one owner for each control and write what it does

Name one owner by role for each control. Write what the control does, how often, and the record it leaves. Use the control inventory so that the owner named in your register is the owner who answers the CPA firm.

• Then: Decide the record, its system and how long it is kept

Step

Decide the record, its system and how long it is kept

For each control name the record it leaves as a by-product of the work, the system of record that holds it, and how long it is kept: at least until the report is issued and for the records period your policy sets. Schedule a control that happens once or twice a year inside the period, because it may not otherwise fall in a short one.

• Then: Does each record pass the four evidence tests?

Decision

Does each record pass the four evidence tests?

The tests are that the record is dated, attributable to a person or system account, retrievable by someone who was not there, and taken straight from the system of record. Someone who does not perform the control checks them. Evidence made up afterwards is not evidence.

• Yes: Is there someone who performs none of the controls to assess them?
• No, or not checked: Fix the way the record is made, at source

Step

Fix the way the record is made, at source

A failed test is a finding to fix at source: record it, give it an owner and a date, and change how the record is made. A record is not tidied or back-dated afterwards. If the record does not exist, say so.

• Then: Is there someone who performs none of the controls to assess them?

Decision

Is there someone who performs none of the controls to assess them?

Nobody tests their own control. The assessor performs none of the controls, owns none and approves none. A manager from another team usually works. An internal audit or compliance function is best where it exists. An outside adviser is useful in a small company. If the adviser is the CPA firm that will examine you, the AICPA Code of Professional Conduct allows some non-attest work for an attest client with safeguards, and management keeps its own responsibilities. The firm confirms its own independence.

• Yes: Walk through each key control and test a handful of occurrences
• No: Do the work anyway and record it as a self-check

Step

Do the work anyway and record it as a self-check

A self-check still finds gaps, but the readiness result says that it was a self-check. Where one person runs most controls, keep the five finding words and the three facts of the start decision.

• Then: Walk through each key control and test a handful of occurrences

Step

Walk through each key control and test a handful of occurrences

Follow one real occurrence of each key control from trigger to record, with the person who performed it, and take the record from the system of record yourself. Then check a handful of occurrences against the written statement. A control that has not run yet is walked through for its design and rated by its level. The CPA firm decides what it samples.

• Then: Record each finding in one of five words and plan each gap

Step

Record each finding in one of five words and plan each gap

The words are design gap, operating gap, evidence gap, scope gap and no gap found. Every gap becomes a row in the deficiency tracker with an owner and a due date, and the retest is done by someone other than the owner.

• Then: Rate the 32 readiness items and read the result in words

Step

Rate the 32 readiness items and read the result in words

Rate each item Not started, Planned, In place or Operating, and choose the lower level when in doubt. The result is one of three words with the counts beside it, never a score, a share or a pass or a fail. 22 of the 32 items are blocking.

• Then: Is any blocking item below In place?

Decision

Is any blocking item below In place?

A blocking item below In place means the observation period should not start yet. Starting with one usually produces an exception on a control that mattered, and a period cannot be restarted without telling the CPA firm. Until every item has a level the result reads Incomplete.

• Yes, or not known: Fix before the period starts, then retest once it has operated
• No: Is a design or operating gap on a key control still open?

Step

Fix before the period starts, then retest once it has operated

Close each gap, then retest after the control has operated for a while, by someone other than its owner. Until then call the control fixed and not yet operated. The row closes only on a retest that finds no gap, so a fix is not closed when it is made.

• Then: Rate the 32 readiness items and read the result in words (back to an earlier step)

Decision

Is a design or operating gap on a key control still open?

The examination owner and the sponsor choose the key controls, the ones the principal commitments depend on, and write the choice down. A design or operating gap on one is usually fixed before the period starts, because it would produce an exception that a retest cannot yet show fixed. An open one is a reason to hold.

• Yes, or not known: Fix before the period starts, then retest once it has operated
• No: Are the period dates agreed in writing with the CPA firm?

Decision

Are the period dates agreed in writing with the CPA firm?

Agree the observation period dates in writing before the period starts, and do not change them in the period without the firm. The pack's house default is that readiness is complete and the dates are agreed 14 days before the period starts.

• Yes: Report to the sponsor in counts and words, and ask for the decision
• No: Hold the start, and tell the customer plainly

Outcome

Hold the start, and tell the customer plainly

A hold states its reasons, the actions and the date of the next decision. Holding is not a failure: a late start is cheaper than a period with a gap in the middle. Tell the customer what has happened by the approved route, and do not promise a date the rule has not yet allowed.

Step

Report to the sponsor in counts and words, and ask for the decision

The sponsor needs the result word, the counts, the blocking items by name, the gaps by priority, the open gaps on key controls, whether the dates are agreed, whether the check was independent or a self-check, and the one decision. Do not say how close you are: 'nearly ready' is a score in words.

• Then: Start the period, and record who decided and when

Outcome

Start the period, and record who decided and when

With no blocking item below In place, no open design or operating gap on a key control and the dates agreed, the decision is Start. Record who decided and when. Assess again before each new period and whenever the scope changes.