The SOC 2 Audit Process
The SOC 2 standard was created by the AICPA. A licensed, certified public accountant must sign all SOC 2 audits. To achieve SOC 2 compliance, most companies spend six months to one year preparing. This preparation includes deciding which systems will be included in the audit (in scope), developing policies and procedures, and implementing new security controls to minimize risk. The first time you complete a SOC 2 audit, you'll receive a SOC 2 Type 1. Most companies want a SOC 2 Type 2. This means to obtain a SOC 2 Type 2, you'll need to complete the SOC 2 Type 1 audit and then conduct a SOC 2 Type 2 audit after 6 to 12 months have elapsed. This distinction can be confusing but is very important.
Here's an easy way to remember: S = SCOPE, T = TIME
SOC 1 = Financial Scope
SOC 2 = Information Security Scope
Type 1 = At a single point in time
Type 2 = Over a period of time (usually 6-12 months)
When an organization is ready to begin the audit, it will hire a licensed CPA auditing firm to conduct the audit. The actual process starts with a scoping discussion and selection of the Trust Service Criteria that will be evaluated by the auditor. The following 6 to 8 weeks are used to collect and submit evidence to the auditing firm, usually through the use of a portal or document request spreadsheet. During the 6 to 8-week period, most auditing firms will hold weekly phone calls to evaluate the quality of evidence and the speed at which the organization is uploading evidence. After the evidence collection period has been finished, the auditors will schedule an onsite audit. This is typically a two-day in-person meeting at your office. Many audits conducted during 2020 and 2021 were "virtual onsite audits" due to Covid-19. These are conducted through video conferencing platforms but function in the same way as traditional onsite audits. While in your office, the auditor will conduct interviews and review evidence items.
Summary
Getting a SOC2 Type2 is a time-intensive process especially during the first year. More detail is available in our SOC 2 Compliance Guide. Use the information above to help guide you on your journey or give us a call to help you successfully plan for and execute your SOC2 Type2 program and audit. We have resources on the East and West Coast for our client’s convenience.
If you would like help with your cybersecurity strategy or goals, give Security Ideals a call for a complimentary consultation. We can be reached at 302-433-6222 or by email at info@securityideals.com.
Comments