A practical starting plan
Download the editable SOC readiness checklist (Excel, 7 KB). Assign owners, record evidence, track status, and set target dates for the ten steps below. This planning aid is not an audit opinion or a compliance guarantee.
Use this checklist to plan a first SOC 1 or SOC 2 examination. It is a starting point for organizing the work, not a substitute for agreeing the engagement with your CPA firm. Management remains responsible for its system, controls, and supporting evidence.
- Confirm the report your customers need. Ask who will use it and why. SOC 1 focuses on controls relevant to customers’ financial reporting; SOC 2 addresses the applicable Trust Services Criteria. Record the requested report type and deadline instead of assuming the two reports are interchangeable.
- Define the service and system boundary. List the services, systems, people, locations, data, and important service providers involved. Identify customer responsibilities and dependencies. Turn this into a short scope document for discussion with the CPA firm.
- Choose a CPA firm based on fit and competence. Ask about relevant industry experience, the proposed team’s qualifications, independence, quality practices, communication, and availability.
- Compare proposals on the same assumptions. Confirm scope, report type, reporting date or period, readiness work, deliverables, fees, and change-order terms. Include your internal preparation effort in the budget. Do not rely on a universal price range or assume a fixed fee covers every change.
- Assign internal ownership. Name a project lead and a responsible person for each control area. Agree how process owners, technical teams, management, and the auditor will communicate. Reserve time for evidence requests and remediation.
- Document the controls you actually operate. For SOC 1, consider the relevant control objectives; for SOC 2, map controls to the applicable criteria. Record each control’s owner, frequency, procedure, and evidence. Management owns the controls; the auditor independently determines the examination procedures.
- Perform a readiness review and fix gaps. Walk through the control activities, inspect a sample of real evidence, and identify missing or inconsistent practices. A readiness review can be internal or supported by an advisor. Clarify any independence implications if the examining firm also provides assistance.
- Set a realistic reporting date or period. A Type 1 report addresses a specified date; a Type 2 report also addresses operating effectiveness over a period. Discuss timing with the auditor and make sure controls and evidence retention are ready. Do not assume a control introduced late covers earlier months.
- Prepare and protect the evidence. Maintain an indexed request list, preserve original records, and use an agreed secure sharing method. Check that evidence identifies the system, activity, and relevant date or period. Track unanswered questions without recreating missing approvals as if they were original.
- Plan for reporting and the next cycle. Review the draft report for factual accuracy, understand identified exceptions, and complete management’s required responsibilities. Assign follow-up actions and keep controls operating after the report is issued.
A useful first meeting pack
Bring a service description, preliminary scope, customer reporting requirements, system and provider inventory, control-owner list, desired timing, and known gaps. These materials make a scoping conversation more productive than a generic claim that you are “audit ready.”
Next steps: contact us, read the SOC 1 guide or SOC 2 guide, and review the SSAE 18 background.
Further reading: AICPA SOC 1 resources and information for service organization management in a SOC 1 engagement.
