SOC 2 audit preparation
What the CPA firm will ask you for, and how to have it waiting.
Fieldwork runs on a request list: a sheet of items the CPA firm needs from you, each with an owner and a due date. Teams that struggle rarely lack controls. They lack the record proving a control ran, or they hand it over late and in a form the tester cannot rely on. This guide walks that list in the order requests usually arrive.
Back to SOC 2 services01 · The request list
Fieldwork is a queue of requests
Many firms call it the PBC list, short for provided by client.
Before testing begins, the firm sends a list built from your draft system description and its own test plan. Each line names a control, the item wanted and the person on your side expected to supply it. A Type 2 list runs long, because most controls are touched twice: once to obtain everything that happened in the period, and again to obtain records for the items picked out of it.
Draft your own copy first
Most requests are predictable. Take each control in your draft description, write down the record it leaves behind and the system that holds it, and you have a rough copy of the firm's list before it arrives.
02 · Five waves
The order requests usually come in
Each wave depends on the one before, so a slow answer early pushes every later date back.
| Wave | What is asked for | Accepted when | Usually answered by |
|---|---|---|---|
| 1. Orientation | Org chart, network and data-flow diagrams, the draft description, in-scope systems and vendors | The diagrams match what runs today | Compliance owner |
| 2. Walkthroughs | A live demonstration of each control, start to finish, on one real instance | The person who runs the control can do it without a script | Each control owner |
| 3. Populations | System-generated lists of every change, joiner, leaver and incident in the period | The list arrives with the query that produced it, and its totals reconcile | Engineering, IT, HR |
| 4. Samples | Records for the specific items the tester picked from each list | Each record is dated inside the period and shows who acted | The owner of each control |
| 5. Follow-ups | Explanations for anything that looked wrong or went missing | The answer gives cause, impact and any other control covering that risk | Compliance owner with the control owner |
A Type 1 engagement largely ends after the walkthroughs, since it judges design at a single date. Waves three and four exist because a Type 2 tests whether controls operated across the whole period.
03 · Populations
Get the full list right and the picks take care of themselves
A tester cannot choose fairly from a list nobody can vouch for.
- Pulled from the source system. An export from the ticketing tool or identity provider, not a sheet someone retyped.
- Bounded by the period dates. The query's first and last day match the examination window exactly.
- Reconciled to a second source. Leavers in the HR system match deactivated accounts in the identity provider, for example.
- Repeatable. Keep the query or filter, so the tester can rerun it and land on the same count.
04 · Evidence that holds
One control, proved weakly and proved well
Most follow-up questions trace back to evidence that was true but could not be checked.
Weak
- A cropped capture with no date or account name
- Approval given in chat after the change shipped
- An access review sheet with no reviewer named
- A backup dashboard showing green today
Strong
- A full-window capture showing the clock, the user and the setting
- Approval recorded on the ticket before the deploy timestamp
- The exported user list, marked up and signed by the reviewer, with a ticket per removal
- Job history across the period, failures included, plus a restore record
A record made after the period closed cannot show that a control worked during it. Collect as you go instead of rebuilding the trail at the end.
05 · Dry run
Rehearse fieldwork before the firm turns up
A short internal pass through waves two to four exposes most gaps while there is still time to act.
- Choose three controls that leave plenty of records, such as change approval, joiners and leavers, and access reviews.
- Ask each owner to walk a colleague through one real instance, out loud, using only the screens they would show a tester.
- Pull each population from its source system and reconcile the count to a second source.
- Pick five items at random across the months and fetch the records for each within one working day.
- Note every item that took too long or did not exist. That note is your fix plan.
Small teams meet one problem more than others: the person who makes a change is the only one able to approve it. Firms generally look for a compensating control written into the description, such as a later review of every privileged change by someone outside engineering, or a pipeline that refuses to deploy unreviewed code.
Sources: AICPA, SOC 2 guide (Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy); AICPA, AT-C section 205, Assertion-Based Examination Engagements; AICPA, DC 200 description criteria; AICPA, 2017 Trust Services Criteria. The order of request waves reflects common practice and varies from firm to firm.
06 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
- The readiness assessment, step by stepWhat it produces, what it doesn't, and how to use the result.
- Who owns each SOC 2 controlA role map from engineering to HR to leadership.
- SOC 2 on a small teamWhat you can simplify, and what no team size excuses.
- Evidence that passesWhat makes an item acceptable: source, date, completeness, owner.
Working through the request list
Who should own the request list on our side?
One person, even when many people answer it.
Give one coordinator the list, the deadlines and the job of chasing. Single items go to control owners, but one person in charge stops duplicate uploads, catches late answers and keeps the story consistent for the tester.
Can the CPA firm tell us what evidence would be enough?
It can explain what it will test, not build your controls.
Firms commonly describe the attributes they will check for each control. Independence rules stop the firm that signs the opinion from designing the controls or producing the records it then examines.
Will a compliance platform answer the list for us?
It can supply many items, not the walkthroughs or the judgement.
Automated collection helps with populations and recurring records. Walkthroughs, explanations of deviations and the management assertion still need people who know how each control really works.
What if a requested record does not exist?
Say so early, with the reason.
Tell the firm as soon as you know, with the cause and whether another control covered the same risk. The tester logs a deviation and weighs it. A record created late to fill the hole usually makes the result worse.
See your request list before the auditor sends it.
A SOC 2 readiness assessment walks your controls the way a tester would, pulls trial populations and ranks what to fix first.