FAQ: What is the difference between a SOC 2 auditor, advisor, and software provider?

The auditor performs the independent examination and issues the report. An advisor can help you define scope, identify gaps, and improve processes. Software can organize work and collect certain evidence. Your management team still owns the system, controls, and decisions. Before buying a package, put those responsibilities in writing: who writes drafts, who approves controls, who fixes gaps, and who answers audit requests? Also identify the actual CPA firm issuing the report. A bundled service can be convenient, but the product name on a sales proposal is not enough to establish who is doing the audit.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC resources; AICPA ethics: SOC tool-provider arrangements.

Additional FAQs

What belongs in a simple SOC 2 control register?

Use one row per control with a stable identifier, a plain-language description, an owner, a frequency or trigger, and an evidence location. Add the relevant criteria mapping, the systems covered,

What controls matter when an AI agent can take actions?

Start by limiting the actions the agent is allowed to take and the systems it can reach. Use an identifiable account, narrow permissions, and approval steps for sensitive or difficult-to-reverse

How many updates to SOC 1 have there been?

SSAE numbers identify attestation standards, not SOC 1 report versions. The major historical changes were SSAE 16 replacing SAS 70 for service-auditor reporting in 2011, followed by SSAE 18 in

Are Representation Letters Required in SSAE 18?

Yes. For SOC 1 examinations, the applicable AT-C requirements call for management’s written representations. This was not entirely new with SSAE 18: SSAE 16, codified in former AT section 801,

What is a SOC 2?

SOC 2 is an independent CPA examination of a service organization’s described system and controls against the applicable Trust Services Criteria. SOC stands for System and Organization Controls. A Type

Should we wait for the proposed SOC 2 updates before improving AI controls?

No. Begin with the AI uses and risks you already have. Identify owners, document data flows, review access, define appropriate human oversight, and retain records of important decisions and evaluations.

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide