FAQ: Can our SOC 2 auditor also help us prepare?

Some preparation assistance may be possible, but independence needs to be evaluated for the actual services and relationships. Ask the CPA firm to explain the permitted scope of help and what management must decide and approve. Be especially clear about who designs, implements, and operates controls, and whether the auditor has a business relationship with the software provider. A readiness package is not automatically a problem, and a separate company name does not automatically solve one. Get the responsibilities and independence discussion settled before work begins, rather than discovering a conflict after the controls have been built.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA ethics: SOC tool-provider arrangements.

Additional FAQs

We have a small company, how do we segregate Board of Directors from Management, and then, also the Internal Audit function?

Map three roles: who runs controls, who oversees management, and who independently evaluates the results. Mark where the same person fills more than one role. For example, a suitably independent

Should we wait for the proposed SOC 2 updates before improving AI controls?

No. Begin with the AI uses and risks you already have. Identify owners, document data flows, review access, define appropriate human oversight, and retain records of important decisions and evaluations.

How can we share audit evidence without exposing unnecessary sensitive data?

Agree on a secure sharing method and limit access to the people who need the evidence. Before uploading, check for credentials, customer content, personal information, and unrelated records. Ask the

What controls matter when an AI agent can take actions?

Start by limiting the actions the agent is allowed to take and the systems it can reach. Use an identifiable account, narrow permissions, and approval steps for sensitive or difficult-to-reverse

Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask: If names or reports cannot be shared, ask for alternative evidence and record

What is covered in the Availability criteria?

The Availability criteria address whether information and systems are available for use as needed to meet the service commitments and system requirements in scope. Practical work includes capacity planning, monitoring,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide