SOC 2 Readiness vs SOC 2 Examination What Comes First

SOC 2 readiness comes before examination because a Type 2 report tests a fixed history of control operation. A separate readiness engagement is optional, but the work of becoming ready is not. For technology and service companies, SOC 1 and SOC 2 examinations build trust by giving customers independent assurance over defined controls.

Why SOC 2 sequencing is a structural question, not a preparation preference

The observation period begins on a chosen date, and controls must operate and generate evidence from that first day. A control added later cannot provide evidence that it ran before it existed. The fixed history of control operation requires the usual progression from assessment through remediation and validation to examination.

A SOC 2 examination is an attestation performed by a licensed CPA firm under AT-C sections 105 and 205, evaluating controls against the Trust Services Criteria. The historical-window constraint applies to Type 2, while Type 1 addresses a specific date. Both produce an opinion. Readiness produces none and is a separate engagement from examination.

What the readiness assessment is actually doing — and what it is not

Readiness is a consulting service. It has no assurance standing and cannot satisfy a customer's vendor-risk requirement. Its purpose is to establish whether the organization can support the claims an examination will test. That requires examining governance and risk management, access and identity management, security operations, third-party risk, and evidence of control effectiveness.

A scoped system boundary establishes what system the report describes by defining the services, products, environments, and data flows covered, with exclusions documented and reasoned. Management decides the boundary, while the readiness provider drafts and challenges it. The selected criteria set then establishes which commitments will be examined. Security is always included, while Availability, Processing Integrity, Confidentiality, and Privacy require reasoned inclusion or exclusion based on service commitments.

A mapped control set links each criterion that applies to named controls, with an owner, how often each control runs, and where its evidence comes from. An unmapped criterion exposes a gap immediately. A separate gap list records the differences between that design and actual operation, with severity, an owner, an action, a target date, and the criteria each correction supports.

The final questions concern proof and timing. An evidence plan identifies each control's population, system of record, extractor, retention period, and means of demonstrating completeness and accuracy. This is not merely a document collection exercise. It establishes whether evidence will still exist when fieldwork begins and whether the auditor can use it. A dated timeline then connects remediation, the earliest defensible observation-period start, and the report date, including the CPA firm's lead time. Together, these six deliverables turn preparation into a supportable examination plan.

How the examination differs from readiness — Type 1, Type 2, and what the auditor is actually testing

The examination begins as a separate engagement, with independent testing. Readiness work does not transfer as assurance credit. The CPA expresses an opinion on management's assertion, using the Trust Services Criteria and description criteria to define what is examined. The AICPA's 2017 criteria provide the foundation, while revised points of focus issued in 2022 updated illustrative considerations without changing the criteria themselves.

Type 1 addresses the fairness of the system description and suitability of control design as of a specific date. Its testing concerns design and implementation at that point. Type 2 also tests operating effectiveness over a specified period, so it needs samples from across that window. The distinction becomes concrete when a quarterly access review due in March runs in April. The later review does not erase the missed timing, and the report records an exception.

Customers often ask for Type 2 during vendor due diligence. Once an organization has an established reporting cycle, they frequently expect a twelve-month period, although the standards do not prescribe a fixed length. Periods of several months to a year are common. For a SaaS company pursuing enterprise deals, the relevant difference is therefore not which report sounds more comprehensive, but whether it supplies the assurance the customer's review requires.

The auditor defines populations, selects samples, and reaches conclusions independently. AT-C section 205 requires inquiry to be paired with inspection, observation, or reperformance, because inquiry alone is insufficient. A platform showing a control as “present” answers a narrower question than whether it operated consistently. Treating readiness testing as completed audit work can consequently leave the examination calendar wrong by weeks.

What skipping readiness costs, in practice

No standard requires a readiness assessment before examination. Skipping it is permitted, but unresolved gaps enter the period that the auditor will test. Consider an employee whose access was not removed within the policy window after termination. A compliance platform may show the offboarding policy as present and green, while the access logs in the sample show the exception. The policy and its successful operation are different claims.

An account may remain active while permissions from the previous role linger, escaping automated tooling because the account was never fully deprovisioned. If a quarterly review happened only once, three of four quarters have no evidence. An examination cannot treat the completed review as proof of the missing ones.

Evidence can also be lost even when a control runs as it should. Month-one logs that age out before fieldwork leave a retention gap that later documentation cannot repair. Retention should be checked before the period opens. Remediation may then require more than changing a setting or correcting a process, because the corrected control must run before it produces a testable population. A control fixed on 1 April has no such population until it operates, making a restarted observation window the honest consequence of a late discovery.

Why readiness timing determines the shape of the examination, not just its outcome

The earliest defensible period start anchors the report schedule. It comes after remediation and evidence maturation, so choosing it based only on a hoped-for sales date is unsafe. A third-party readiness assessment typically takes one to two months from engagement through delivery of a control set. Significant remediation, such as implementing a ticketing system, a SIEM, or a risk assessment process, typically takes one to six months before examination can begin.

A first assessment typically consumes 35–50 hours of client time across six to nine people through scope definition, document sharing, and stakeholder interviews. Those commitments arrive before remediation work begins. If the people are not booked, the schedule slips, and the earliest credible observation-period start moves with it. The multi-month observation period and subsequent examination then determine when the report can be available for customer review.

A hybrid approach can compress preparation without assuming readiness. The recommended sequence is self-assessment to learn the framework and correct obvious gaps, followed by external readiness work to challenge the team's scoring, then remediation before opening the audit window. This preserves an independent challenge before the historical record begins. This approach provides an opportunity to resolve problems while they are still preparation tasks, before they become exceptions within the examination period.

The independence boundary between readiness and examination, and why it matters who does each

A provider that makes control-design or scoping decisions for management and then opines on those decisions creates an independence problem that safeguards cannot cure. The AICPA's nonattest services provisions in ET 1.295 draw the boundary. A firm may identify gaps, draft control descriptions for management to evaluate, and advise, but management must make the decisions and accept responsibility for the results.

Deciding the control set, writing policies as the client's own work, operating controls on the client's behalf, or choosing scope is incompatible with later opining on that work. Using separate readiness and examination firms avoids that conflict cleanly. An organization using one firm for both should confirm that its readiness services remained within the nonattest boundary. Independence gives customers reason to distinguish an examination opinion from an endorsement of the provider's own decisions.

Pressure for fast, low-cost reports can encourage excessive reliance on inquiry, although proper testing requires more. A clean result calls for a closer look if the controls had little testing. Proposed revisions to AT-C 105, 205, and 210 would strengthen evidence and risk-assessment provisions, but no final standard had been issued as of August 22, 2026. The practical implication is to evaluate the reliability of testing.

How service organizations with overlapping compliance obligations — SOC 1, mortgage banking, multifamily housing — fit the same readiness logic

SOC 1 and SOC 2 answer distinct customer questions. SOC 1 examines controls that could affect a user entity's financial reporting, while SOC 2 addresses controls tied to security, availability, processing integrity, confidentiality, and privacy. Neither substitutes for the other. Payroll providers, medical claims processors, loan and mortgage servicers, transfer agents, and trust and custody operations commonly need SOC 1 reports. When both reports are needed, readiness must cover each scope and the controls that apply to it on their own.

A mortgage servicer with a borrower-facing portal illustrates the overlap. Investors may require SOC 1 assurance over controls that relate to Internal Control over Financial Reporting, while prospects and regulators seek SOC 2 assurance on data security. Under SSAE 18, AT-C 320, external auditors must obtain assurance over the servicer's controls when a user entity relies on it for financial-reporting processes. GSE servicing guides and institutional investors typically require Type 2. Sustained performance, rather than a design snapshot, answers their concern.

Multifamily housing operators add another calendar to this reasoning. HUD financial reporting obligations are distinct from SOC examinations, but managing multiple compliance schedules makes readiness planning more consequential. The readiness-first logic still holds because each examination needs the right controls and evidence for its own scope and period, even when the organization must coordinate that work with other reporting demands.

What audit-ready actually means at the point the observation period opens

On day one, every control in scope is operating, generating evidence, and owned by a named person. The evidence source is known, and retention supports the examination window. No dashboard can substitute for those conditions. Readiness is measured by the gap between what the organization says it does, what it actually does, and what it can prove. An examination needs the third.

An external readiness professional questions that gap before it becomes part of the history an examination will test. Teams assessing themselves can score intent, treating “we do access reviews” as sufficient even when nobody has documented one. An external assessment samples real evidence and checks consistent operation. That check can lead to a later start date than management hoped for.

For buyers of assurance services, the selection criteria follow from these demands. The readiness provider should respect the nonattest boundary, and the examination firm should demonstrate depth in the relevant criteria and industry context. Its proposed timeline should allow for evidence maturation as well as time to find gaps. Specialized assurance is recognizable in that combination of independence, relevant expertise, and realistic timing. Those are the qualities to look for in a firm whose report customers will use to judge whether trust is warranted.