Lesson 3.46: Getting ready for a SOC 2 audit
Large customers ask suppliers for a SOC 2 report: an independent auditor's opinion, under the AICPA's Trust Services Criteria, on whether the supplier's controls are designed well (Type I, at a point in time) and also worked throughout a period (Type II, usually six to twelve months). The audit itself is mostly evidence collection, so readiness work happens months before. In the lab you check Northwind's control matrix against the planned scope: coverage of the criteria, controls without owners or evidence, controls not tested recently, and what the observation period will need.
17 min
You will learn to
- Explain SOC 2, the Trust Services Criteria and Type I vs Type II
- Map a control matrix to the criteria in scope
- Find controls without owner or evidence
- Find controls not tested recently
- Plan evidence for an observation period
Key terms
- SOC 2
- An attestation report by an independent CPA firm on a service organisation's controls, under the AICPA's Trust Services Criteria.
- Trust Services Criteria
- Security (common criteria), Availability, Processing Integrity, Confidentiality, Privacy.
- Type I / Type II
- Design at a point in time / design and operating effectiveness over a period.
- Control matrix
- The list of controls with criteria, owner, frequency and evidence.
- Observation period
- The period a Type II report covers, often 6–12 months.
← Security exceptions and risk acceptance · All lessons · The three lines model and independence →