Don’t Fear the Audit—4 Ways to Prepare for SOC 2

Originally published by BARR Advisory.

Written by Kyle Cohlmia.

If you’ve made the commitment to achieve a SOC 2 report, you know the outcome will help differentiate your organization as one who takes the security of your customer data seriously. Even if this isn’t your first SOC 2 engagement, there can be common misconceptions about the process that could hinder the success of your audit.

So how can you best prepare? Planning ahead for the dates of your audit can help you avoid common mistakes and ensure your organization is on the path to reach your security and compliance goals.

We sat down with Cameron Kline, director of attest services at BARR, to discuss best practices for organizations of all sizes preparing for a SOC 2 audit. Let’s take a look at his advice.

Assign Roles to the Right People

Before starting your SOC 2 audit, it’s important to assign specific roles to the right people. You’ll be responsible for maintaining communication during your audit and designating the appropriate person to share relevant information.

“Not having the correct people in place can lead to delays and exceptions,” said Kline. “It’s helpful for the people who know your controls best to serve at the forefront of your audit journey. Since they are the ones working with your controls on a day-to-day basis, it will help to assign them as lead or project manager for when the time comes to answer pertinent questions about your organization.”

Here are a few tips to assigning roles prior to your audit:

• Create a plan and confirm expectations with your teammates beforehand to ensure you’re organized and ready to dive into your audit.
• Select the right people for the right job so communication will flow smoothly and the correct information is being transferred.
• Designate a project manager who can serve as the sounding board and organizer for your team, saving time and avoiding miscommunication.

Lean on Your Readiness Assessment

The readiness period of your SOC 2 audit prepares your organization’s policies and procedures so your assessment runs smoothly. Readiness assessments test the controls that will be examined during your audit, and your engagement lead will provide recommendations for remediation.

Benefits of conducting your readiness assessment include:

• Initial testing of controls
• Recommendations for remediation
• Remediation of issues
• Reduces chances of unexpected control gaps

Tailor Your Scope

There’s no one-size fits-all approach to identifying your scope, so it’s important to think about your organization’s individual needs. For your SOC 2 report, you’ll want to think about the five trust services criteria—security (required), availability, confidentiality, processing integrity, and privacy—and which categories best address your customer data.

“You don’t need to include every system in your scope,” said Kline. “If you’re adding too much, it could cost time; while too few criteria may result in more questions from customers or not remediating the right controls.”

You also want to avoid scope creep, which involves changing your scope after the project begins.

“Scope creep occurs when you try to move too many systems around after we’ve already started your audit. This will increase time and the likelihood of risk, so it’s important to identify and tailor your scope ahead of time. When scope creep happens, there will inevitably be exceptions to your systems and controls,” said Kline.

A few questions your auditor will ask your organization when defining your scope include:

• How is your customer data stored?
• Does this system process, store, or transmit customer data?
• Which systems are critical in commitments to your customers?
• If one system goes down, will it impact customers?

Combine Other Frameworks with SOC 2

While SOC 2 reports are an excellent way to build trust within your organization, it’s important to think of the big picture to your security roadmap. Consider a continuous security program that includes recurring SOC reports as well as other frameworks as you grow.