FAQ: What if we change a major system during the SOC 2 period?

Tell the auditor early and keep a dated change record. Explain what changed, which controls were affected, when the new process began, and where evidence from both versions is stored. A move to a new identity provider, for example, can affect access lists, approvals, and termination evidence. Preserve the old records before shutting the system down. Update your system description and control documentation where appropriate. The auditor will assess the effect on scope and testing; a change does not automatically mean the whole period must restart. Agree on the evidence handoff before the migration rather than during fieldwork.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC 2 reporting guide overview.

Additional FAQs

What if no employee left or no incident occurred during the period?

Do not manufacture an event to fill an evidence request. Confirm that there really were no relevant occurrences and retain the records supporting that conclusion. For departures, that might involve

How should we control the accounts used by audit automation?

Give each integration only the access needed for its task, and assign a business owner. Prefer identifiable service accounts or supported application identities over a shared employee login. Record the

Does a green automated check prove the control is working?

Not by itself. It provides evidence only about what the check measures, and only if its data and logic are reliable. Ask which systems are included, when the check last

What should happen after we approve a vendor?

Assign an owner to keep the review current and follow up when circumstances change. Triggers can include: Set a review schedule that fits the risk and applicable obligations. Review sooner

What are the SOC 2 criteria?

The five SOC 2 categories are Security, Availability, Processing Integrity, Confidentiality, and Privacy. Not every SOC 2 report covers all five categories. Read the report to see which categories and

Can employees put customer data into an AI tool?

Only after the organization has approved that use and confirmed the relevant data, contractual, security, and privacy requirements. Check the provider's applicable terms and settings, including retention, training use, access,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide