What we do
Pick a service, find your industry, or start from what you are trying to get done.
Explore What we doBrowse What we do
View allProfit360™
Our way of turning your finance function into a source of profit.
Explore Profit360™Browse Profit360™
View allGlobal
A coordinated approach to cross-border finance, tax and assurance questions.
Explore GlobalBrowse Global
View allInsights
Tax changes, finance thinking and what they mean for your business.
Explore InsightsBrowse Insights
View allAbout
Who we are, who you will work with, and how we hold ourselves to account.
Explore AboutBrowse About
View allCareers
Build a career in US accounting, tax and advisory.
Explore CareersBrowse Careers
View allServices
Specialist work across compliance, assurance, finance and growth.
Explore ServicesBrowse Services
View allAudit & Attestation
SOC 2 Audit
SOC 2 readiness and examination support for service organizations that need to show how selected controls are designed and, for a Type 2 report, how they operated over a period.
The value
What does a SOC 2 audit show a customer?
Turn a SOC 2 request into a clear choice of report type, Trust Services Criteria, system boundary, and evidence plan before an examination is considered.
Typical scope
What does a SOC 2 engagement include?
The final engagement is tailored to your facts. These are the core workstreams we use to define a useful, responsible scope.
01
Report purpose and intended users
02
Type 1 or Type 2 discussion
03
Trust Services Criteria selection
04
System description and control-owner mapping
05
Readiness observations
06
SOC 2 examination support, subject to engagement acceptance
How the engagement moves
How does a SOC 2 audit move forward?
- 1→
Understand the ask
We start with who will use the report and what decision they are trying to make. A security questionnaire, contract clause, or investor request is usually enough to begin.
- 2→
Choose the report shape
Type 1 addresses design at a point in time. Type 2 also addresses operating effectiveness over a period. Security is always in scope. Other criteria are added only when they are relevant to that audience.
- 3→
Organize the system
Management’s description of the service, the systems that deliver it, the control owners, and the records those controls produce are put into one baseline.
- 4
Decide the next engagement
Gaps are named with owners. An examination is a separate acceptance decision. Readiness does not itself produce a SOC 2 report.
Compare
How do SOC 2 Type 1 and Type 2 differ?
Type 1 and Type 2 answer different questions. The better choice is the one the intended users need, not the label that sounds stronger.
| What differs | Type 1 | Type 2 |
|---|---|---|
| What the report addresses | Whether the controls are suitably designed at a specified point in time. | Design, and whether those controls operated effectively over a specified period. |
| What has to exist first | A system description and controls whose design can be examined at that date. | A period of operation. There is no single timeline. Type 2 periods are commonly three to twelve months; the period is set in planning. |
| What else affects timing | Timing is set in planning. It also depends on readiness, evidence quality, and the availability of control owners. | A Type 2 report needs that period of operation, plus the same readiness, evidence, and control-owner constraints. |
| Which criteria are included | Security is always in scope. Availability, processing integrity, confidentiality, and privacy are added only when they are relevant to the service and to the users of the report. | The same. Type 2 does not add criteria. It adds testing of operating effectiveness over the period. |
| Who signs the report | AT&F signs its own SOC report on design at a point in time, when an examination is accepted and completed. Readiness does not itself produce the report. | AT&F signs its own SOC report on design and operating effectiveness over the period, when an examination is accepted and completed. Readiness does not itself produce the report. |
What to have ready
What should you have ready for a SOC 2 audit?
What you can expect
What do you receive from a SOC 2 engagement?
Common questions
Common questions about SOC 2 audits
The quickest way to get a firm answer is to share the facts that make your situation different.
What is a SOC 2 audit?+
A SOC 2 examination is an attestation engagement under the AICPA’s SOC 2 framework. It considers a service organization’s description of its system and the controls relevant to the Trust Services Criteria selected for the engagement. It is not a certification, and it is not a promise that every incident will be prevented.
What is the difference between SOC 2 Type 1 and Type 2?+
A Type 1 report addresses whether controls are suitably designed at a specified point in time. A Type 2 report also addresses whether those controls operated effectively over a specified period. The better choice is the one the intended users need, not the label that sounds stronger.
Does SOC 2 cover only security?+
Security is always included. Availability, processing integrity, confidentiality, and privacy can be added when they are relevant to the service and to the users of the report. Those additional criteria are selected for the engagement.
Can the same firm prepare the controls and examine them?+
Readiness support and an examination are different activities. Management remains responsible for the system, the controls, the description, and the assertion. Whether an examination can be accepted depends on independence, scope, and professional requirements, and that is decided before any engagement letter.
How long does a SOC 2 report take?+
There is no single timeline. A Type 2 report needs a period of operation, and the calendar also depends on readiness, evidence quality, and the availability of control owners. Timing is set in planning.
Related assurance
Which SOC or ISO page matches your request?
SOC 1, SOC 2, a startup buyer request, and ISO certification readiness are related. They are not the same engagement.
SOC 1 and SOC 2
Start here when the request could be a SOC 1 report, a SOC 2 report, or both.
Read the pageSOC 2 for startups
A smaller, customer-led way to scope SOC 2 when the company is still early.
Read the pageISO readiness
For buyers who asked for an ISO certificate rather than, or as well as, SOC 2.
Read the pageUS tax for international founders
Form 5472, FBAR, NRI returns, India and FEMA, and startup tax, when the company behind the SOC 2 request has a foreign owner.
Read the pageUseful reading
What should you read before a SOC 2 decision?
Practical perspectives that may help frame the next question. They are general information, not advice based on your particular records, facts or current rules.
Audit & assurance
SOC 2 Type 1 or Type 2: start with the decision your customer needs to make
A practical way to frame the report conversation around intended users, system boundaries, evidence and timing—before selecting labels or dates.
Read articleAudit & assurance
SOC 2 readiness: build an evidence plan before you need it
A practical, non-technical way to organise ownership, controls and evidence before a SOC 2 examination begins.
Read articleAudit & assurance
SOC 2 evidence walkthroughs: help control owners show the work, not recreate it
A practical way to prepare control owners for evidence walkthroughs by connecting each activity to its trigger, record, reviewer and exceptions.
Read articleStart with a conversation
What is the right next step for a SOC 2 request?
SOC 2 work follows the applicable AICPA attestation standards and Trust Services Criteria. A readiness conversation is not a SOC 2 report and does not determine the outcome of an examination.