SOC 2 evidence collection without the grind
Evidence is where a first SOC 2 quietly goes wrong. The controls are usually fine. The record of them operating is what does not exist.
SOC 2 evidence is the record that a control operated, produced at the time it operated. Auditors accept system-generated artifacts with a visible date, an identifiable system and an identifiable actor: exports, tickets, logs, signed approvals and configuration captures. They reject assertions, undated screenshots, and anything assembled after the fact to describe something that happened months ago.
The workload is manageable if you set it up before the observation window opens. It becomes somebody's full-time job when you try to reconstruct nine months of it in the two weeks before fieldwork.
What counts as evidence
Rank your evidence sources and always use the highest one available for a given control.
| Type | Why it ranks here | Typical use |
|---|---|---|
| System export or report | Generated by the system, timestamped, hard to fabricate | User lists, merge history, patch status, training completion |
| Ticket with approval trail | Carries requester, approver and date without extra effort | Access grants, changes, incidents, vendor reviews |
| Log entry | Contemporaneous and complete | Authentication events, alerts, administrative actions |
| Signed or acknowledged document | Attributable, with a date attached | Policy approvals, confidentiality agreements, review sign-offs |
| Screenshot of a configuration | Point in time only, and only as good as what is in frame | Cloud settings, enforcement policies, retention settings |
| A written statement from you | Not evidence. It is the claim the evidence has to support | Nothing, on its own |
Screenshots are the most common form and the most commonly rejected. A usable screenshot shows the full browser or console window including the system identity, the account signed in, the date visible somewhere on screen, and the setting itself without cropping. A cropped image of a toggle proves nothing about which account, which environment or which day.
How sampling works, and why populations matter
For a Type 2, the auditor does not review every change or every hire. They ask you for the complete population for the period, then select a sample from it and request evidence for each selected item. That means the population list matters as much as the evidence itself.
Populations you will be asked for typically include every employee and contractor hired during the period, every one who left, every production change deployed, every access grant to production, every incident logged, every vendor added, and every alert of a defined severity.
An incomplete population is worse than a missing control
If your list of terminations omits a contractor and the auditor finds them through another route, the issue is no longer that one offboarding. It is whether any of your populations can be relied on, and that question can expand testing across the whole engagement. Build populations from a system query rather than from memory, and use the same query every time.
The collection routine
Split evidence by when it has to exist. Most of the pain in a first audit comes from treating everything as a year-end task.
| Cadence | Items | Effort per cycle |
|---|---|---|
| Continuous, no human effort | Logs, merge history, alert history, ticket trails | Zero once configured |
| Per event | Onboarding checklist, offboarding checklist, access grant approval, incident record | Minutes, if the checklist is the process rather than a copy of it |
| Monthly | Vulnerability scan output, patch status, backup success record | Under an hour |
| Quarterly or annual | Access reviews, vendor reviews, policy review, training completion | A few hours, and the most commonly missed |
| Once in the period | Risk assessment, penetration test, restore test, tabletop exercise | A day each, schedule them early |
For the periodic items, the calendar entry is the control. Put a recurring event on one named person's calendar, not a shared team calendar, with the folder path in the description and a reminder a week ahead. Nearly every missed quarterly review traces back to it being nobody's specific job on a specific day.
Organizing it so fieldwork is boring
Use one folder per control, named with the control identifier and a short
label. Inside, name every file with the date first in ISO format, then the
system, then what it shows. A file called
2026-04-14-okta-access-review-production.pdf answers the auditor's
first three questions before they open it.
Keep a single index, a spreadsheet is fine, with one row per control listing the owner, the cadence, where the evidence lives and the date it was last collected. That index is also your status board during the window: any row whose last-collected date has gone stale is a control drifting, and you find out in a glance rather than at fieldwork.
Two habits save real time later. Capture evidence in the same session as the work, because a screenshot taken while you are already in the console costs seconds and taken three months later costs a meeting. And never delete superseded evidence, since the auditor tests a period, not a current state, and the version from March is the one that matters for March.
Where automation helps and where it does not
Compliance platforms connect to your cloud, identity provider, code repository and device management, and continuously collect a slice of the evidence. At $8,000 to $30,000 CAD a year they are worth it when your infrastructure is concentrated with providers the platform integrates with, and when you have enough people that manual collection would otherwise be a real cost.
What automation covers well is configuration state and user lists. What it does not cover is anything involving human judgement: a completed access review with someone's decision recorded, an approved policy, a vendor assessment, a tabletop, a risk assessment, an incident write-up. That remainder is a meaningful share of the evidence in a first audit and it is the part people underestimate when they assume a platform makes this automatic.
If you are not buying a platform, a scheduled script that exports user lists and cloud configuration to dated files in object storage does a surprising share of the same job for the cost of an afternoon.
Mistakes that cost real money
Log retention shorter than the observation window. Default retention is often thirty days. A ninety day window then has sixty days of missing evidence with no way to recover it. Check this before anything else.
Starting collection after the window opens. The first weeks are the ones nobody covers, and they are as testable as the last weeks.
Evidence that predates the period. An access review from before the window started does not evidence a control operating during it. At least one full cycle of every periodic control has to fall inside the period.
Rebuilding a record to look right. Reconstructing an approval trail after the fact is not a documentation exercise, and an auditor who spots it has a problem with your integrity rather than with your control. A missing item plus an honest explanation is recoverable. A manufactured one is not.
Forgetting the penetration test evidence. The test report is one artifact. The other is proof that you fixed what it found, and auditors ask for both.
Not sure your evidence would hold up
Send us your control list and where you are in the window, and we will tell you what an auditor would push back on.
Get matchedCommon questions
How much evidence does a SOC 2 Type 2 audit need?
Expect a request list in the low hundreds of items for a first audit against the security criterion, though many are single artifacts covering several controls. The volume is less of a problem than the timing: items have to exist across the whole period, so a steady routine is far easier than a large push at the end.
Are screenshots acceptable as SOC 2 evidence?
Yes, for configuration and for systems that cannot export. They must show the system, the signed-in account and the date without cropping, and they must be taken during the period they support. Where an export exists, use the export, because it is faster to produce and harder to question.
What if we missed a quarterly access review during the period?
Tell the auditor rather than running one late and dating it back. A missed cycle usually results in an exception noted in the report, which is survivable and which many customers accept alongside your remediation plan. Backdating is a different category of problem and it can end the engagement with the firm.
Can we use a compliance platform's evidence directly in the audit?
Generally yes. Auditors are used to platform exports and many firms have integrations that pull them in. They will still test whether the integration covers what you claim, and they will ask separately for everything the platform does not touch, which is most of the manual and judgement-based controls.
Who should own evidence collection?
One named person coordinating, with the periodic items assigned to the people who actually do that work. Access reviews belong to whoever administers the identity provider, not to the compliance owner, because a review completed by someone without the context is a rubber stamp and auditors ask who performed it.