The readiness assessment, explained from the deliverables back.

The assessor reads your systems, policies and practices against the criteria you plan to report on, talks to the people who run each control, and looks at sample evidence. The aim is to find design gaps and evidence gaps while they're still cheap to fix, before a CPA firm tests them and writes the results into a report.

Scope statement

The services, system components, locations, vendors and Trust Services categories in scope, and what is left out.

Control matrix

Each control mapped to the criteria it addresses, with its owner, frequency and where its evidence lives.

Gap list ranked by risk

Every missing or weak control, ranked by how much it matters to the criteria and to your customers, not by how easy it is.

Remediation plan

For each gap: the fix, the owner and the order of work, with the items that must run before a Type 2 period can start flagged.

A good gap list says why each item is a gap, citing the criterion. A list of tool recommendations with no criteria attached is a sales pitch, not an assessment.

A SOC 2 examination is an attestation engagement under the AICPA standards, and the CPA firm performing it must be independent of you. A readiness provider often drafts policies, designs controls and helps write the system description. If the examining firm did that work, it would end up testing its own design. Keeping the two roles with separate firms removes that question entirely.

1. 01

   Scope

   Agree what the report will cover.

   What happens

   • Lists services and system components
   • Picks Trust Services categories
   • Names subservice organizations

   You get

   • A draft scope statement

   Good practice

   • Scope matched to what customers buy

   Watch for

   • Scoping the whole company by default

2. 02

   Discover

   Learn how things really run today.

   What happens

   • Interviews control performers
   • Reads policies and configurations
   • Looks at sample evidence

   You get

   • A current-state view per criterion

   Good practice

   • Talking to the people who do the work

   Watch for

   • Relying on policy text alone

3. 03

   Map and rank

   Compare what exists with what the criteria ask.

   What happens

   • Builds the control matrix
   • Identifies design and evidence gaps
   • Ranks gaps by risk

   You get

   • Control matrix
   • Ranked gap list

   Good practice

   • Each gap tied to a criterion

   Watch for

   • Ranking by convenience

4. 04

   Plan

   Turn the gaps into work.

   What happens

   • Assigns owners and order
   • Flags pre-period must-haves
   • Agrees an evidence approach

   You get

   • Remediation plan

   Good practice

   • One accountable name per fix

   Watch for

   • A plan nobody owns

1. Fix design gaps first. A control that doesn't exist can't start building evidence.
2. Then fix evidence gaps: controls that run but leave no dated record.
3. Write the final control wording only once the fix is in place, so the description matches reality.
4. Run each recurring control at least once before the period, as a dry run.
5. Re-check the riskiest items before you engage the CPA firm.

• Treating it as a pass. There is no pass. A short gap list still has to be closed and proven over a period.
• Fixing the easy items first. Cosmetic wins look like progress while high-risk gaps sit untouched.
• Copying the matrix into the description unchanged. Readiness wording is often aspirational. The description must state what actually runs.
• Showing it to customers. It isn't assurance. Buyers who rely on it are relying on advice, not an opinion.

Sources: AICPA AT-C sections 105 and 205; AICPA Code of Professional Conduct, independence rules; AICPA TSP section 100; AICPA DC section 200; AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization.