SOC2Prep

Are we ready for a SOC 2 auditor?

One question, answered honestly: is it time to engage an audit firm, or is that a call you will waste. Six questions, about a minute.

Last reviewed 2026-08-27Written by Jacob Masse, TrazTech Inc.

Engaging an audit firm too early is a common and expensive way to lose a quarter. The firm quotes against a scope you have not settled, the fieldwork dates get booked against a window that cannot open on time, and the engagement then sits idle while you do the preparation you could have done first. Talking to firms too late is the other failure, because Canadian firms are often booked a quarter ahead.

This says which side of that line you are on. If you are ready, it sends you to the auditors. If not, it says what the next piece of work is.

Is your scope written down?

A system description naming the product, the environments, the data and what is deliberately excluded.

Are your policies written, approved and acknowledged?

Are the controls actually running?

Enforced multi-factor authentication, reviewed access, peer-reviewed changes, logging, an incident process and a vendor register.

Is evidence being collected as you go?

Which report has been asked for?

When does the report have to exist?

What ready actually means

Ready for an auditor is not the same as compliant. It means four things are true: your scope is settled enough that a firm can quote against it, your controls exist and are running, evidence is accumulating rather than waiting to be assembled, and you know which report type you have been asked for. None of those requires perfection, and a firm expects to find things. What it cannot do is audit a period you have no record of.

The one question this cannot answer for you is whether your scope is defensible, which is a conversation about your architecture rather than a checkbox. If you are unsure what belongs inside it, settle that before anything else. It changes the quote, the evidence and the report.

Common questions

When should we start talking to SOC 2 audit firms?

Once your controls are running and you have decided your observation window dates, which is usually a few weeks before the window opens rather than after it closes. Canadian firms are often booked a quarter ahead, so the conversation has to start early enough that fieldwork dates exist when you need them. Talking to a firm before your scope is written wastes the call, because the quote depends on it.

Can an audit firm start while we are still remediating?

They can engage and book dates, and many will. What they cannot do is begin fieldwork on a period during which your controls were not operating. Booking early is sensible. Starting the observation window before the controls run is the mistake, because that period is then in the report with the gaps in it.

What if a customer wants the report next month?

A Type 2 needs an observation window, three months at the shortest, before an auditor can begin. If the deadline is inside that, the honest options are a Type 1, which tests design at a single date, or a letter from the audit firm confirming the engagement is under way with a target date. Most enterprise buyers accept one of the two once, on the understanding a Type 2 follows.

Do we need a readiness assessment before engaging an auditor?

Not always. If your team has been through this before and your evidence is running, your own honest review may be enough. A paid readiness assessment earns its money when the date is set by a contract, when the environment is complicated, or when an earlier attempt already stalled.