SOC 2 Type 1 and Type 2 Readiness and Audit Support

Flow chart of the SOC 2 engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Criteria Selection. We choose which Trust Services Criteria apply and decide whether to start with a Type 1 or go straight to Type 2. Activities: Select the Trust Services Criteria in scope; Decide the Type 1 or Type 2 path and timing; Define system boundaries for the report; Shortlist audit firms and align on timeline. Hands over Scope Memo and Audit Roadmap. Phase 2, Gap Assessment. We measure your controls against the criteria and give you a clear list of what to fix before the audit. Activities: Map existing controls to each criterion; Interview engineering, HR, and IT control owners; Test key controls for design and evidence; Rank gaps by audit impact and effort. Hands over Readiness Assessment Report. Phase 3, Control Design and Remediation. We help you design and implement the controls, from access reviews to change management and monitoring. Activities: Draft policies for access, change, and incidents; Implement quarterly access reviews; Stand up change management and monitoring controls; Assign owners for every control in the matrix. Hands over Control Matrix and Remediated Control Set. Phase 4, Evidence Automation. We connect a compliance platform so evidence collects itself, which is essential for the observation period of a Type 2. Activities: Connect cloud, HR, and code repositories to the platform; Map automated tests to each control; Set alerts for failing evidence checks; Close manual evidence gaps with owners. Hands over Automated Evidence Collection Setup. Phase 5, Observation Period Support. For Type 2, we help you run the controls consistently across the audit window and watch for drift. Activities: Monitor control performance across the window; Review platform alerts and fix drift early; Document exceptions and remediation; Run monthly check-ins with control owners. Hands over Clean Observation Period Evidence Trail. Phase 6, Audit Support. We work alongside your auditor through fieldwork so the report lands without surprises. Activities: Manage auditor evidence requests; Prepare control owners for walkthroughs; Respond to exceptions before they become findings; Review the draft report and management assertion. Hands over SOC 2 Report. Each phase begins from the artefact the phase before it produced.