FAQ: What is the difference between a SOC 2 auditor, advisor, and software provider?

The auditor performs the independent examination and issues the report. An advisor can help you define scope, identify gaps, and improve processes. Software can organize work and collect certain evidence. Your management team still owns the system, controls, and decisions. Before buying a package, put those responsibilities in writing: who writes drafts, who approves controls, who fixes gaps, and who answers audit requests? Also identify the actual CPA firm issuing the report. A bundled service can be convenient, but the product name on a sales proposal is not enough to establish who is doing the audit.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC resources; AICPA ethics: SOC tool-provider arrangements.

Additional FAQs

How long does a SOC 1 take to complete?

There is no fixed completion time. Estimate three parts: getting controls and evidence ready, the period a Type 2 report will cover, and the auditor’s fieldwork and report review. Some

What if no employee left or no incident occurred during the period?

Do not manufacture an event to fill an evidence request. Confirm that there really were no relevant occurrences and retain the records supporting that conclusion. For departures, that might involve

How many updates to SOC 1 have there been?

SSAE numbers identify attestation standards, not SOC 1 report versions. The major historical changes were SSAE 16 replacing SAS 70 for service-auditor reporting in 2011, followed by SSAE 18 in

Are Representation Letters Required in SSAE 18?

Yes. For SOC 1 examinations, the applicable AT-C requirements call for management’s written representations. This was not entirely new with SSAE 18: SSAE 16, codified in former AT section 801,

Does a SOC 2 report certify that an AI product is safe or accurate?

No. A SOC 2 report addresses the described system and controls against the applicable criteria within the engagement's scope. It is not a blanket certification of an AI product's safety,

What should we do when SOC 2 evidence is missing?

Record the gap and tell the control owner promptly. Determine whether the activity happened without a retained record, did not happen, or cannot be established from available information. Look for

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide