A SOC 2 walkthrough is a discussion about how a process works. The auditor may ask you to explain the steps and show supporting records. You do not need to memorize the SOC 2 criteria. You need to describe your own work accurately.
For example, an HR owner might explain how IT learns that an employee is leaving. An engineer might show how a software change is reviewed before release.
Before the meeting
- Ask which process and time period the discussion covers.
- Find the current procedure and the records requested.
- Check that the people who perform the work can attend.
- Confirm the approved way to share screens and evidence.
If the auditor has selected particular records, use those records. Do not replace them with cleaner examples. If nothing has been selected, ask whether a representative example would help.
Close unrelated documents before screen sharing. Do not display passwords or other sensitive material that is not needed for the review.
During the walkthrough
Start with what triggers the process. Explain who does the work and how you know it is finished. Show where the record is kept.
The auditor may ask how you handle an unusual case or what happens when a step fails. Explain the real process, including any gaps. A policy describes what should happen; the records help show what did happen.
It is fine to say, “I need to check that.” Name the person who can answer and agree how you will follow up. Guessing creates more work when the records tell a different story.
Do not stage a better process
You can organize your materials beforehand. You should not create backdated approvals or present a new process as if it operated throughout the period.
If a workflow changed, say when. Help the auditor distinguish the earlier process from the current one. See how to match control descriptions to actual practice for help checking that distinction.
Leave with a short follow-up list
- What information is still needed?
- Who will provide it?
- When is it due?
A completed meeting is not a passing audit result. The auditor may need more evidence or testing after understanding the process.
Source: Schellman’s guide to first-year and recurring SOC 2 examinations explains the role of walkthroughs between control owners and assessors. The preparation suggestions above are practical guidance, not a required meeting script.