Preparing for your first SOC 2 audit means scoping the report, choosing which Trust Services Criteria apply, running a readiness assessment, then collecting evidence that your controls work in practice. SOC 2 is an AICPA attestation performed by a licensed CPA firm, not a certification. Most of the effort is preparation, not the audit.
How do you scope a SOC 2 audit and choose Trust Services Criteria?
Scope is the first decision and it shapes everything after it. SOC 2 is assessed against the Trust Services Criteria defined by the AICPA. The Security category, also called the Common Criteria, is mandatory in every SOC 2 report. The other four categories are optional: Availability, Processing Integrity, Confidentiality and Privacy. You include each one only if it is relevant to the service you are reporting on and to what your customers actually need to see.
For a first audit, most SaaS startups report on Security alone, sometimes with Availability or Confidentiality added because a large customer has asked for it. Adding categories you do not need increases the number of controls you have to operate and evidence, so the sensible approach is to start from what your buyers are requesting in their security questionnaires rather than reaching for all five.
Scope also covers which systems, products and locations the report describes. Limiting the system boundary to the product and infrastructure that handle customer data keeps a first audit manageable without weakening the result. The systems you exclude need a defensible reason, because the auditor will expect the boundary to match how the service really runs.
What is the difference between a readiness assessment and the audit?
A readiness assessment is the rehearsal; the audit is the real thing. A readiness assessment, sometimes called a gap assessment, checks your controls against the Trust Services Criteria before the CPA firm begins formal fieldwork. It tells you which controls are missing, which are designed but not yet operating, and where your evidence is thin. You can run it yourself, with a consultancy, or with the audit firm under a separate engagement.
The audit is the formal examination that produces the report. This is where the type of report matters. A SOC 2 Type 1 report assesses whether your controls are suitably designed at a single point in time. A SOC 2 Type 2 report goes further and tests whether those controls operated effectively over a period, commonly three to twelve months. We explain the choice in detail in SOC 2 Type 1 vs Type 2.
The practical sequence for a first-timer is usually readiness first, then remediation of whatever the assessment surfaced, then the audit. Skipping readiness and going straight to a Type 2 audit is the most reliable way to turn gaps into exceptions in your final report.
What does evidence collection actually involve?
Evidence collection is the part teams consistently underestimate. For a Type 1 report you are showing that a control exists and is designed properly, so a policy, a configuration screenshot or a system setting is often enough. For a Type 2 report you have to show the control operated throughout the audit period, which means evidence with dates attached across the whole window, not a snapshot taken the week before fieldwork.
Typical evidence includes access reviews, onboarding and offboarding records, change management approvals, incident tickets, vendor risk reviews, backup and monitoring logs, and signed policy acknowledgements. The areas auditors probe hardest tend to be access management, change management, incident response and vendor risk, so those are worth getting right first.
The reality is that a Type 2 audit tests a period that has already happened. If a quarterly access review was meant to run in month two and nobody did it, you cannot recreate that evidence later. This is why starting evidence collection the moment a control goes live, rather than when the audit opens, is the single most useful habit a first-time team can build. Automation through a compliance platform helps, but the auditor still expects to see human oversight, approvals and review, not just tool output.
What are the common first-audit failures?
The most common failure is treating SOC 2 as a documentation exercise. Writing policies is the easy part; the auditor checks whether the controls those policies describe are actually followed. A clean policy library with no evidence that anyone acts on it produces exceptions, not a clean report.
Other recurring problems include starting evidence collection too late, so periodic controls have gaps that cannot be backfilled; scoping too broadly and committing to criteria or systems that add work without adding value; and a mismatch between what the policies say and how the company runs, where a control is documented at a frequency the team never actually meets. Under-resourcing the project is the quiet one: the work needs a named owner with time allocated, not a side task squeezed between feature releases.
How do you work with the auditor (the CPA firm)?
A SOC 2 examination must be performed by a licensed CPA firm. That is an AICPA requirement and it is what separates a genuine SOC 2 report from a self-assessment or a platform dashboard. A consultancy or compliance tool can help you prepare, but only the CPA firm can issue the attestation, and the firm must remain independent, which means it cannot both build your controls and audit them.
In practice the auditor agrees the scope and criteria with you, requests evidence against each control, raises questions where something is unclear, and documents any exceptions where a control did not operate as described. Your job is to give complete, well-organised evidence and clear, honest answers. Choosing the firm matters too: look for experience auditing SaaS companies of your size, a sensible view of automated evidence, and a timeline that fits your sales commitments.
What is a realistic timeline for a first SOC 2 audit?
The honest answer is that it depends on how much of a control environment you already have and which report you are pursuing. A Type 1 report can be reached relatively quickly once controls are designed and in place, because it assesses design at a point in time. A Type 2 report takes longer by definition, because the auditor has to observe your controls operating across a period that commonly runs from three to twelve months.
A common path for a startup is to achieve a Type 1 report first to satisfy an immediate buyer, then run a Type 2 observation period and report afterwards. The variable that moves the timeline most is your starting point: a team with documented access controls, change management and monitoring already running needs far less preparation than one starting from nothing. We have not put fixed week counts here because any single number quoted online tends to mislead; the determinant is readiness, not a calendar.
How Atoro helps
Atoro is Europe’s first ISO 42001 certified consultancy, with more than 200 certifications delivered across security and compliance. We help SaaS companies scope their first SOC 2 sensibly, run a readiness assessment, build the missing controls and evidence routines, and prepare the team for auditor questions, while the independent CPA firm performs the attestation. See our SOC 2 implementation service for how the engagement works.
SOC 2 audit preparation FAQs
Is SOC 2 a certification?
No. SOC 2 is an attestation defined by the AICPA, not a certification. A licensed CPA firm examines your controls against the Trust Services Criteria and issues a report with their opinion. There is no certificate and no certification body, which is the main difference from a standard like ISO 27001.
Who can perform a SOC 2 audit?
Only a licensed CPA firm can perform a SOC 2 examination and issue the report. This is an AICPA requirement. Consultancies and compliance platforms can help you prepare, but they cannot issue the attestation, and the audit firm must stay independent from the work of building your controls.
Which Trust Services Criteria do I need for my first audit?
The Security category, also called the Common Criteria, is mandatory in every SOC 2 report. Availability, Processing Integrity, Confidentiality and Privacy are optional and added only where relevant to your service and your customers. Most first audits cover Security alone, sometimes with Availability or Confidentiality if a buyer has asked.
Should my first SOC 2 report be Type 1 or Type 2?
It depends on what your buyer needs and how mature your controls are. A Type 1 report assesses control design at a point in time and can be reached faster. A Type 2 report tests whether controls operated effectively over a period. Many startups do a Type 1 first, then a Type 2 once an observation period has run.
What is a readiness assessment?
A readiness assessment checks your controls against the Trust Services Criteria before the formal audit begins. It identifies missing controls, weak evidence and gaps you can fix in advance. Running readiness before the audit is the most reliable way to avoid turning preparation gaps into exceptions in your final report.
What evidence does a SOC 2 audit require?
Typical evidence includes access reviews, onboarding and offboarding records, change approvals, incident tickets, vendor risk reviews, monitoring and backup logs, and policy acknowledgements. For a Type 2 report the evidence must show controls operating with dates across the whole audit period, not just a snapshot taken shortly before fieldwork.
Why do first SOC 2 audits commonly fail or get delayed?
The usual reasons are treating SOC 2 as a documentation exercise rather than running the controls, starting evidence collection too late so periodic controls have gaps, scoping too broadly, and under-resourcing the project. The work needs a named owner with time allocated, not a task squeezed between product releases.
How long does a first SOC 2 audit take?
It depends on your starting point and the report type. A Type 1 report can be reached relatively quickly once controls are in place. A Type 2 report takes longer because the auditor observes controls operating over a period, commonly three to twelve months. A team with controls already running needs far less preparation than one starting from nothing.