Avoidable mistakes
Ten SOC 2 pitfalls, and what to do instead.
Most SOC 2 trouble is process and ownership, not technology. It clusters in three places: scoping, the observation period and the examination itself.
Back to SOC 2 services01 · Scoping
Scoping pitfalls
Decisions that shape every later phase.
- 1 · Every category “to look thorough”. Each optional category is criteria you must meet every year. Scope to real commitments.
- 2 · A boundary that misses the product. A clean report about the wrong system doesn't help buyers.
- 3 · Skipping readiness. Going straight to fieldwork turns every gap into an exception.
02 · Operating period
Operating-period pitfalls
A Type 2 reports what actually ran.
- 4 · Starting the period too early. Each control has to be live and leaving records from the first day of the window.
- 5 · Evidence made after the fact. Timestamps give it away; it can't be recreated.
- 6 · The platform on autopilot. A tool collects evidence; it doesn't own controls.
- 7 · One person owns everything. Leave or illness becomes a gap in the population.
03 · Examination
Examination pitfalls
How you handle findings matters as much as having few.
- 8 · Hiding exceptions, or panicking. Disclosed and fixed exceptions are survivable; concealment isn't.
- 9 · Overclaiming mid-journey. “Certified” or “compliant” before a report exists undermines trust.
- 10 · Letting the report lapse. A gap between periods can't be filled later.
04 · Risky wording
Risky wording against sound wording
Many pitfalls start as a sentence in a sales deck or a questionnaire.
| Where it appears | Risky wording | Sound wording |
|---|---|---|
| Website or deck | We are SOC 2 compliant. | Our examination is under way with an independent CPA firm; we will share the report when it is issued. |
| Questionnaire | All controls are fully automated. | Access reviews and backups run on a schedule, with a named owner who checks the results. |
| Sales call | SOC 2 certified. | Our latest SOC 2 Type 2 report covers the stated period and system. |
| Management assertion | No exceptions are expected. | Management describes the system as it operated and discloses known deviations. |
| System description | Every customer system is protected. | The boundary covers the named product, its hosting and the people who support it. |
No one certifies you under SOC 2: a licensed CPA firm gives an attestation (an opinion), and that is all it is. Say what exists today, for which period, and nothing more.
05 · By phase
More pitfalls, grouped by phase
Beyond the ten above, watch for these. Each points to a page that goes deeper.
- Scoping
- Forgetting the vendors your system relies on, or splitting several products without a clear boundary.
- Evidence
- Keeping screenshots without dates, or evidence that shows a setting but not that the control ran.
- The period
- A tool, vendor or key person changes mid-window and nobody tells the auditor.
- The report
- Reading the opinion but not the exceptions, or sharing a report that has aged out.
- Subservice organizations: vendors inside your reportWho counts, how they're monitored, and what the report must say.
- Evidence that passesWhat makes an item acceptable: source, date, completeness, owner.
- Changing systems mid-auditHow the observation period copes with migrations, tools and people.
- How long a SOC 2 report stays usefulThe age buyers accept, and what to do when yours ages out.
- “SOC 2 in progress”: what you can honestly sayWording that is true at each stage, and wording to avoid.
06 · First week
You found one: what to do in the first week
The order matters more than the speed.
- Write it down as a plain statement of what happened, when, and which control or criterion it touches.
- Name an owner for the fix and for talking to the auditor.
- Contain it so it stops repeating, before you polish the paperwork.
- Tell the examiner early. A deviation raised by you is easier to handle than one they find.
- Record the fix with dated evidence, and note how you will know it holds.
Do not rewrite history
Backdated documents and edited logs turn a small exception into a question about integrity. Fix forward, and let the record show what really happened.
Sources: AICPA SOC 2 guide and the Trust Services Criteria (TSP 100); AT-C section 205 on examination engagements.
More about SOC 2 pitfalls
Is an exception the same as a failed audit?
No. A SOC 2 report is not pass or fail.
The auditor reports on the fairness of the description and the operation of controls, and lists exceptions where they found them. Buyers read the exceptions and your response, so a clear, fixed one is often acceptable.
Can a tool prevent these pitfalls?
It helps with evidence, not with ownership.
A platform can collect and date records. It cannot decide your scope, own a control, or judge whether wording is accurate. Those stay with people.
Who should read the draft report first?
Someone who can challenge it, not only approve it.
Have both the technical owner and a leader who signs the assertion read the draft, checking each claim against what actually happened.
What's the single most common SOC 2 mistake?
Starting the observation period before controls run.
Once the period opens, every missed occurrence is in the population. Start it only when controls are in place and operating, with evidence flowing.
Find the pitfalls before your auditor does.
A SOC 2 readiness assessment checks scope, ownership and evidence before the period starts.