How to get through a SOC 2 audit once you have an auditor

What happens during the audit

Only a CPA or CPA firm can issue a SOC 2 report, so the audit is done by an outside firm and not by software, as Linford & Co's guide to SOC 2 Type 2 reports explains. The firm meets the people who run each control, asks for records showing the control ran, and then writes up the results.

A Type 1 report tests your controls on one date. A Type 2 report tests whether they kept working over a review period, generally 3 to 12 months, according to BARR Advisory's guide to SOC reporting periods. You and the firm agree the period in the engagement letter, before testing starts.

The auditor's work can take from a week to more than a month, depending on how complex you are and how quickly you respond, according to Linford & Co's guide to SOC 2 Type 2 reports.

In SimpleAudit you set up the audit as Type 1 or Type 2, with its period dates and your auditor's contact details. The page shows the days left and a timeline worked back from your target report date. Those dates keep your team on schedule. They do not replace your auditor's own plan.

What your auditor will ask for

Expect evidence requests across your whole operation. Schneider Downs' list of SOC 2 evidence sorts them into eight groups, including new hires, logical security, change management and vendor management, and notes that the list changes with each engagement.

For a Type 2, the auditor picks samples from across the period, working from a full list of what the control applied to. Auditors call that list a population. In one worked example from Linford & Co's guide to audit sampling, a list of 389 employees starts with a sample of 25, and one failure grows the sample to 40.

A failed sample is disclosed in the report, but it does not by itself change the auditor's opinion. Linford & Co's guide to audit opinions explains that the auditor weighs how many failures there are, their combined effect, and any other controls that make up for them.

SimpleAudit keeps the lists your auditor can use as populations: people, access reviews, vendors, risks and assets. Choosing the samples and testing them stays with your auditor.

Keep your policies and evidence in step

Your auditor reads your policies and then tests whether your records match them. If your access policy says quarterly reviews and your records show one review last year, that gap is what Policy vs. Reality is built to catch first.

Every night it uses AI to compare what your policies commit to with your evidence and records, then flags where they disagree. It reads what you have uploaded and recorded. It does not connect to your systems, so it knows your real set-up only through those records. You decide how to resolve each finding.

Evidence goes stale as well. Each evidence requirement can run on a yearly, quarterly or monthly cycle. SimpleAudit marks evidence as expiring before it lapses and adds a task to renew it, so you are not collecting it again the week your auditor asks.

If your own systems can produce evidence, push it through the API or MCP from a script, a build pipeline or an AI agent, using a token that can only add evidence. SimpleAudit never reaches into your systems, and a person confirms anything an agent attaches to a control.

What your auditor sees

You give your auditor read-only access by inviting them with the auditor role. They can view and download your policies, evidence and registers. They cannot change anything or use the AI assistant, because SimpleAudit refuses those requests on the server. Their downloads are logged.

You can also download one audit package: a ZIP with your policies as PDFs, your evidence files, your registers and an index. Evidence is limited to the audit period, and you can sort the package by area or by control.

Your auditor still has to check what comes out of any tool, including ours. Linford & Co's review of the AICPA FAQs on automation tools explains that a firm cannot simply take a report from a tool and issue it, and that a tool company cannot also do the audit. SimpleAudit does neither.

The recurring work auditors look for

Some controls have to run more than once. Schneider Downs' list of SOC 2 evidence lists a yearly policy review among the evidence auditors ask for. In SimpleAudit each policy has a review date, yearly by default. The person who created the policy gets an email reminder, and an overdue policy goes back for re-approval.

Access reviews are recorded per application, with each decision kept. An admin can also record each person's policy acknowledgment, training, background check and NDA status.

Tabletop exercises test your incident response, disaster recovery or business continuity plan. AI writes a scenario from your environment, you run the session with your team, and the signed-off report is filed as evidence.

Keep selling during the audit

Sales conversations carry on while the audit runs. Prove includes a trust center for sharing your documents with buyers, security questionnaires answered from your records and policies, and contract reviews that check security clauses against what you do.

When your report is issued

Record the issued report in SimpleAudit while you are on Prove. Once it is recorded, the Sell plan becomes available to you. Moving to it is your choice, and it does not happen on its own.

Stepping down deletes nothing. Your approved policies and evidence stay in place, read-only, and Sell comes with up to 5 seats.

Sell does not include the audit package or new audits, so download the package before you step down. When your next audit starts, step back up to Prove.

The other two stages

SOC 2 work has three stages, and this page covers the middle one. Getting ready comes before it, and using your report to win deals comes after it.

• Get audit ready
• Win deals with your report

The plan for this stage

Prove starts with a 3-day free trial with no credit card.