What readiness should cover, when to involve your auditor, which gaps matter most, and how readiness, Type 1 and Type 2 can work as one continuous engagement. A practical guide to preparing for a report your customers can rely on.
SOC 2 readiness is no longer necessarily a separate project. Ten years ago the standard path was a standalone readiness assessment, then a Type 1 audit, then a Type 2 audit. Each had its own fee and was managed as its own project.
Today the three increasingly run as one blended engagement, because they all work toward the same goal: a report your customers can rely on. Below are the questions companies ask most about readiness, with straight answers.
A SOC 2 readiness assessment is your auditor checking your controls before the audit, so you and the auditor have a shared understanding of what compliance requires. SOC 2 spans many control areas, each with its own details and interpretations.
A readiness check turns that ambiguity into clear direction. It shows what's covered, what's missing, and where your effort is better spent. It is an assessment and feedback process, not an assurance report or a guarantee of the eventual audit outcome.
Readiness used to be a standalone project. The auditor ran an assessment, delivered a report, and came back months later once you had worked through it. Today readiness, Type 1 and Type 2 can be one continuous engagement.
Readiness is often performed in the same engagement as a Type 1, and the Type 1 report is issued once the necessary assessment is complete. A Type 1 can also be issued at a date within the Type 2 period, because it assesses the description and design of the same controls at a point in time; the Type 2 also tests their operating effectiveness over a period. See our guide to which comes first, Type 1 or Type 2 for how the reports fit together.
Audit firms may call the early work 'readiness', but evidence they validate can contribute to the audit itself where it meets the audit requirements. Where evidence is missing, especially in a Type 1, you put the controls in place and gather appropriate evidence as part of the same process.
| Stage | Separate projects | One continuous engagement |
|---|---|---|
| Readiness | A separate assessment, fee and remediation project | Early assessment and feedback; relevant evidence feeds into the audit |
| Type 1 | A new project after readiness | A point-in-time report once ready, potentially within the Type 2 period |
| Type 2 | Another project after Type 1 | Period-wide testing builds on the earlier work |
With so many control areas and details, it's very common to go too far in some areas and not far enough in others. AI can make this more likely: it draws on practice guidance from across the internet and can get carried away overworking some controls.
Doing more than the minimum isn't a problem in itself. The risk is that effort piles into a few areas while others that matter just as much are missed. Readiness guidance from your auditor rebalances that effort and gives you a clear direction.
For AI-native teams, giving an agent the company-specific context is part of that balance. Our guide to Compliance Brain explains what that context should contain. An agent can help you prepare; it doesn't replace the auditor's independent assessment.
Readiness matters most when you go straight into a Type 2 without a Type 1 first. Type 2 fieldwork is usually concentrated toward the end of the observation period, so testing can cover the full period rather than require multiple rounds.
That timing has a catch. A gap that isn't spotted until the end may have produced exceptions all the way through the period. By then it's too late to recreate a control that never operated, and a material or pervasive issue can affect the auditor's opinion.
Readiness work before the period starts, or early in the period, finds those gaps before they continue throughout it. Fixing a gap early limits further issues; it does not erase exceptions that have already occurred.
Not every control is equally urgent once the period starts, and your auditor can help you prioritise. Controls that operate quarterly or annually may leave time to perform the required activity within the period, depending on their scheduled frequency and any commitments you have made.
Controls that run continuously, like approving new users' access and removing leavers, can produce exceptions from day one if they aren't operating. An auditor who explains how the controls will be tested helps you put effort where it protects the report first.
Agree the scope, control frequencies and evidence expectations before starting the clock. Don't assume an annual activity can simply be deferred if it was already due, or that writing a policy later proves a control operated earlier.
Auditors work across many companies, so they can share the options available and what's common in companies like yours. Typical questions during readiness include:
We don't have vulnerability scanning. What tools do companies on our stack use?
How can a small team enforce segregation of duties in change management?
What's a workable way to test and approve changes?
That independent perspective, with tips and insights along the way, is where a good auditor proves worth its weight in gold. Your team still evaluates the options, makes the decisions and implements the controls. For budgeting across the audit and optional services, see the all-in SOC 2 cost guide.
If you start with a Type 1, the readiness work can flow into the Type 1 audit. During readiness, the auditor is already assessing your controls and collecting relevant evidence.
Once the gaps are closed and the required audit procedures are complete, that work can support the Type 1 report. There need not be a second project to start. The report relates to a specified date when the controls are in place; it does not demonstrate their operation over a period.
A substantial part of the preparation and design assessment can happen early. In our experience, roughly 20% of controls depend heavily on occurrences through the period, such as new hires, system changes or incidents. The other roughly 80% can often have much of their design assessment and core evidence collection completed during readiness: documented policies, the risk register, the vendor register and similar.
Those percentages are an experience-based illustration, not a fixed rule or a statement that 80% of operating-effectiveness testing can be completed before the period. The mix depends on your controls, their frequency, the audit scope and the auditor's methodology.
Period-specific testing and updated evidence still follow where needed. Doing the early work takes pressure off the end of the period and makes for a smoother audit without reducing what the Type 2 must demonstrate.
There are two main depths, and either can run at different times. Choose the depth based on how much confidence and direction you need, not just what the assessment is called.
| Type | What it covers | Best for |
|---|---|---|
| Full assessment | Every control in depth; suitable evidence can contribute to the Type 1 or Type 2 audit | Companies that want readiness to flow straight into the audit |
| High-level assessment | The riskier areas most prone to exceptions; policies sense-checked for coverage rather than reviewed line by line | Companies that want a quick steer before committing |
The gaps that matter most are the ones you can't fix after the fact. If you can't show a new user's access was approved, or that changes went through proper change control, that can create material issues in the report. Those activities can't be performed retrospectively as though they happened at the time.
Policy wording is different. Refinements to otherwise adequate policy documentation often become feedback you can address, rather than a report issue. Missing required policies, or policies that don't match what actually happens, can still matter. A high-level check confirms the necessary coverage, then focuses effort on operational controls.
You still need an auditor's assessment of readiness. A compliance platform shows controls and their status through automated tests and built-in designs, but a green dashboard is not an audit opinion. Some checks only establish that a file is attached, not that its contents demonstrate the control.
Even a well-designed platform can't replace the auditor's judgement and methodology, which the audit ultimately rests on. Skipping that conversation leaves more room for surprises later.
Engaging your auditor early works with the platform, not against it. The auditor can evaluate the work already done and focus on the highest-risk areas. The same applies when an AI agent collects or prepares your evidence; see Do I still need a compliance platform?. For the platform trade-offs in general, read do you need a compliance platform?
They can, and some companies use consultants or rely on their platform for readiness. The risk is alignment. A consultant may assess against different expectations or a different methodology than your auditor will use.
A 'ready' verdict from someone else doesn't guarantee a smooth audit. Readiness from your audit firm uses the same assessment approach as the audit. If you use a consultant, involve the auditor early enough to confirm scope, expectations and what evidence will be needed.
No, as long as the auditor stays within the line the standards draw. Audit standards allow audit firms to assess controls, give feedback and make high-level recommendations, subject to the applicable independence requirements.
What an auditor can't do is take management responsibility for designing or implementing your control activities and then independently audit that work. Your management makes the decisions and owns the controls. Within that line, a firm can perform iterative assessment and feedback without becoming the team running your compliance program.
Before choosing the firm, check your SOC 2 auditor's credentials and ask how it maintains independence during readiness. Also meet the person who will lead your audit and confirm how continuity works from readiness through subsequent audits.
Usually not separately when it is part of your audit engagement. Many audit firms include readiness in their audit services. Checking things before the full audit is good practice, and it is related work an auditor should be doing anyway. A standalone assessment may be priced differently, so confirm the scope and terms rather than assuming all offers are the same.
Some audit firms prefer to stay out of readiness altogether. If a firm prices readiness as a separate project, ask whether that work also counts toward the audit itself and what you will pay for again later.
Throughline includes readiness assessments free with every audit. Proactive assessment and good feedback support smoother audits and better outcomes for clients, more efficient audits for us, and long-term client relationships. No readiness assessment guarantees a report without exceptions.
The aim isn't simply to get a dashboard green. It's to prepare for a quality SOC 2 report your customers can rely on. If you want to discuss your scope, timing and next steps, join a Compliance Strategy Workshop.
Former PwC manager, founder of AssuranceLab and former Sensiba partner and Chief Innovation Officer. Now co-founder of Throughline, focused on compliance and assurance for AI-native companies.
SOC 2 for AI-native companies: simpler stacks, agents running the program in your own tools, concise policies, and a report that covers AI in production.
ISO 42001 isn't yet an enterprise requirement. What it covers, how it compares with SOC 2 and AIUC-1, and when it's worth it for an AI company.
How to cover production AI agents in SOC 2: governance, access, change management and monitoring, with indicative criteria mappings, customer responsibilities and practical audit expectations.
Australian companies need a SOC 2 report issued under the AICPA standards by a US-licensed CPA firm, delivered by a strong local team in Australian time zones. Here's how the provider options compare, and what to check.
Experienced CTOs don't choose a SOC 2 audit firm on price or speed. They look for tech stack expertise, a tailored approach, flexible scheduling, responsiveness and year-round partnership, because those factors decide how much time the audit really costs.
What Security, Availability, Confidentiality, Processing Integrity and Privacy each cover, how often they're included, and how to decide which belong in your SOC 2 report.
Which SOC 2 report should come first? Six client cases, practical decision tables and an illustrative 18-month cost comparison explain when to start with Type 1 and when to go straight to Type 2.
How long a SOC 2 Type 2 observation period should be, how to work backwards from a customer deadline, when auditors test, why reports run late and how much buffer to build in.
A category-by-category SOC 2 budget in USD, covering audit fees, readiness, platforms, penetration testing, consultants, internal assessments and operational costs. Learn what is required, what is optional, and what a quote can leave out.
Five signals of real quality in assurance and security, with practical guidance on building a compliance program that supports customer TPRM, repeatable enterprise reviews and revenue growth.
The person leading your SOC 2 audit is the most underrated factor in choosing an audit firm. Companies compare price, timelines and platform integrations, then barely ask who will actually do the work.
SOC 2 is a risk report, not a certificate. Understand how enterprise customers use it, why having a report is only base camp, and how to turn your audit into a trust asset for growing revenue.
CPA firm registration, signing licenses and peer review are the starting point, not proof of quality. A practical guide to checking credentials and asking the questions that matter before choosing your SOC 2 auditor.
Neither is better for everyone. The right choice depends on your customers, how you run security and where you are headed. For AI-native and AI-centric companies, SOC 2's flexible criteria usually make it the stronger starting point.
There's a basic psychology behind why most people don't like audits. Fix this, and people are surprisingly happy to do them again.
Enterprise buyers use SOC 2 as an initial qualifier, then look deeper. A quality report is what carries you through that assessment and turns your compliance investment into real trust.
Audit quality isn't service quality, and it isn't only professional standards. The real test is whether a reader of your report thinks: this tells me what I need to know.
Enterprise security teams review you in the background and rarely give feedback. What they look at beyond SOC 2, what counts as a genuine pen test, and how a quality report does the heavy lifting.
Compliance from first principles, the 95% problem, the compliance metadata AI needs, rethinking screenshots, spreadsheets and policies, and why audits should meet clients where they are.