Reviewed November 9, 2026.
Your customer has asked for a SOC 2 report. An audit firm offers one package. An advisor and a software company offer others. What help do you actually need?
Separate preparation from the independent examination. Also decide who will operate the controls. Each proposal should make those responsibilities clear.
You may prepare internally or use outside help. A CPA firm performs the examination. Choose the support that addresses gaps your team cannot reasonably handle.
Define What You Need to Deliver
What has the customer actually requested? Confirm which report they need and which service it must cover. Clarify the expected categories and deadline. Discuss those needs with the prospective auditor before promising a delivery date.
A request for a SOC 2 report does not tell you whether your policies reflect actual practice or whether evidence exists for the intended period. Start with a short internal assessment of those questions.
Example: A software company has an experienced security lead but no one coordinating requests across HR, engineering, and operations. Its immediate problem may be project ownership and evidence collection rather than a missing monitoring platform.
Write down your main gaps before reviewing demonstrations or proposals. Otherwise, it is easy to buy a capability while leaving the actual problem unassigned.
Understand the Auditor’s Role
Who issues the report? SOC 2 is an examination performed by a licensed, independent CPA under AICPA attestation standards. The auditor evaluates the evidence and forms the opinion; a software subscription or completed readiness checklist does not replace that examination. See the AICPA’s description of SOC 2.
Ask whether the firm has examined systems like yours. Find out who will do the work and how findings will be discussed. Confirm which legal entity will sign the engagement and issue the report.
Ask the audit firm:
- How will we agree the scope?
- What evidence will you request?
- How will you discuss exceptions with us?
- What is included in the fee, and what would require additional work?
The goal is a clear engagement, not a promise of a particular opinion.
Decide Whether You Need Readiness or Advisory Help
An advisor can help your team assess gaps, document processes, organize a control register, or manage preparation. The specific deliverables depend on the agreement. Ask for them in writing.
A useful readiness engagement should leave your team able to operate the processes after the advisor leaves. Name owners for the controls and evidence. Decide who can approve policies and accept risks. Your organization keeps those responsibilities.
Example: An advisor helps document employee offboarding. HR and IT agree on the trigger, responsible people, and evidence to keep. IT then performs the access removals, and the designated reviewer checks completion. A policy document alone would not demonstrate that the process operated.
If the same firm offers preparation and examination services, ask it to explain the permitted boundaries and how it addresses independence. Do not assume every combination of services is appropriate.
Evaluate Software Against an Actual Task
Software can help collect records and track work. Some tools also flag configuration issues. Ask what is automated and what still needs human review. Check what the product does not cover.
Pick one process for the demonstration. For example, ask the provider to show how an access review moves from a source-system export to an owner decision, a correction, and retained evidence. Our access review guidance gives you a practical process to discuss.
Check these points before committing:
- Does the product cover your systems and manual processes?
- Who reviews incomplete or incorrect collected evidence?
- Can you export usable records if you leave?
- What access does the provider need, and how is it controlled?
- Is the audit separate, and can you choose the audit firm?
The AICPA’s April 2026 Ethics Staff Insights on SOC tool-provider arrangements identifies independence and objectivity considerations in these business relationships. Ask about the relationship rather than assuming that a bundled package resolves every responsibility.
Consider Internal Preparation
Can you prepare without buying a new platform? In some organizations, existing ticketing, document storage, calendars, and a controlled workbook can support the preparation work. You still need people with the time and knowledge to maintain them, and the independent examination remains separate.
To start internally:
- Assign a coordinator.
- List the processes in scope and name each owner.
- Agree where evidence will be retained.
- Walk through a few completed records with the owners to identify gaps.
Be honest about capacity. Internal preparation is not free if it pulls key people away from other responsibilities. Equally, adding software will not resolve an ownership problem by itself.
Compare the Whole Plan
Compare proposals against the same plan. Include preparation and fixes as well as evidence collection. Include the examination and report. Do not forget the ongoing work of operating the controls. Mark who performs each activity and who approves it.
Check what each price includes and what it leaves out. Identify work your own team must do. Agree how providers will hand work over to one another. Include what happens after the report.
Need help deciding where preparation support would be useful? Contact a SOC consultant to discuss your scope, current processes, and available resources.