FAQ: When should AI use be discussed with our SOC 2 auditor?

Bring it up when AI is part of the service being examined, supports an in-scope process, handles relevant information, or affects how a control operates. Explain the use case, provider, data flow, permissions, review steps, and evidence available. Internal use can matter even when customers never see an AI feature. For example, AI-assisted support or engineering may affect information handling or changes to the service. Do not wait for a new AI-specific criterion to ask the question. The auditor can evaluate the relevance to the agreed scope and discuss how the system description and testing should address it.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC 2 reporting guide overview; AICPA SOC resources.

Additional FAQs

How can we share audit evidence without exposing unnecessary sensitive data?

Agree on a secure sharing method and limit access to the people who need the evidence. Before uploading, check for credentials, customer content, personal information, and unrelated records. Ask the

What belongs in a simple SOC 2 control register?

Use one row per control with a stable identifier, a plain-language description, an owner, a frequency or trigger, and an evidence location. Add the relevant criteria mapping, the systems covered,

How should we organize SOC 2 evidence folders?

Choose a structure the whole team can explain, such as reporting period, control identifier, and activity date. Keep an index linking each requested item to its location and owner. Separate

What should we settle before asking for SOC 2 audit quotes?

Start with a short scope brief. Name the service customers use, the legal entity providing it, the systems supporting it, and the report customers expect. Include your target delivery date,

What should we do when SOC 2 evidence is missing?

Record the gap and tell the control owner promptly. Determine whether the activity happened without a retained record, did not happen, or cannot be established from available information. Look for

How do we keep recurring SOC 2 tasks from being missed?

Create a calendar from the actual controls, not from a generic monthly checklist. Include the owner, backup, due date, evidence required, and escalation contact for each recurring activity. Add event-driven

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide