Getting through SOC 2 fieldwork without stalling the team

Fieldwork goes fastest when one person owns the request list, populations go out first, every item has an owner and an internal deadline, and walkthroughs are rehearsed. Aim to answer each request within two working days, and raise anything you cannot produce the day you find out.

Last reviewed 2026-10-01Written by Jacob Masse, TrazTech Inc.

Fieldwork is the stretch of a SOC 2 audit where the CPA firm tests your controls: it sends a request list, picks samples, walks through controls with the people who run them and raises any exceptions. For a small company it usually runs two to six weeks. The companies that lose two or three months here do not have worse controls. They have no system for answering the auditor.

This is that system. It works the same whether you use a compliance platform or a shared folder, and whether the audit is a Type 1 or a Type 2.

What should be ready before fieldwork starts?

0 of 0 done · Reset

• A scope memo the auditor has countersigned: boundary, criteria, period, subservice method
• The system description, read by someone who did not write it
• A named liaison and a named owner for each control area
• Populations exported and checked for completeness
• Policies approved and dated inside or before the period
• Subservice organisation reports collected, with your review of each
• Calendar holds for walkthroughs with every control owner

Why one liaison?

Because the auditor will otherwise email whoever answered last, and within a week nobody knows what has been sent. The liaison receives every request, assigns it, checks the answer before it goes, and keeps the log. They do not produce the evidence themselves; they make sure it arrives. In a small company this is a few hours a week through readiness and most of a week during the heaviest part of fieldwork.

What does the request tracker need?

The SOC 2 audit request list page shows what the list itself looks like and which items are commonly misread.

How fast should you answer requests?

Aim for two working days per request, and same day for anything that blocks sampling. The elapsed time of fieldwork is set by your slowest answers, not your average ones. Track it: if the tracker shows a control area that is always late, the owner needs help or the evidence is not being collected as the control runs.

How do you prepare for walkthroughs?

A walkthrough is the auditor watching a control owner show the control working, usually on a screen share. Rehearse each one once. The owner should be able to say what the control is, how often it runs, where the evidence lives and what happens when it fails, in under fifteen minutes, without reading the policy aloud. Answer the question asked; volunteering detail about a different process invites a new request.

What happens in the weekly status call?

Fifteen minutes, the liaison and the auditor's senior, three items: open requests on each side, potential exceptions the auditor has spotted, and anything blocking. Send notes the same day. The call is where scope questions get settled before they become disputes, and where you hear about a possible exception while there is still time to find missing evidence.

How should you handle a potential exception?

1. Check it is accurate. Evidence sometimes exists and was sent under the wrong request.
2. If evidence is genuinely missing, say so the same day. Nothing created after the period counts for a Type 2.
3. Draft management's response while the facts are fresh: what happened, why, whether it was isolated, what changed and from when.
4. Fix the control now, so it runs for the rest of the period.

If requests start to look broader than your scope, GetSOC2 has a page on what to do when the auditor asks for more than the criteria require, and the wider approach to the relationship is on managing your SOC 2 auditor.

Common questions