SOC 2 auditor questions: what examiners ask, who they ask, and the evidence that answers them

How a SOC 2 examiner turns a question into a test

Each examiner question starts a test of one control, and the CPA firm has four ways to test. Inquiry is the conversation itself. Observation is watching the control run, such as a screen share of the ticketing tool. Inspection is examining the records the control produced: the leaver ticket, the directory log, the disable date. Re-performance is the examiner running the control again, for instance re-checking an access review against the system and comparing results.

An opinion cannot rest on inquiry alone, so every answer is followed by a request to see something. The best preparation is therefore not rehearsing answers but confirming that the evidence behind each one exists, is dated inside the period and is easy to retrieve. In a Type 1 the questions test design at a date; in a Type 2 they return with a request for proof across the period. The fieldwork sequence itself is covered in our guide to the SOC 2 examination.

Why the first request is the whole population

Teams expecting to show "a few examples" are often asked for every item instead. For a manual control that runs many times, the examiner first wants the complete list for the period: all hires and leavers, all production changes, all incidents, all vendor onboardings. That list is reconciled with an independent source, such as the HR system, the code repository or the cloud audit log. The examiner then selects items spread across the period.

For your preparation, know which system is the authoritative source for each population and export it with dates; check that populations agree, because a leaver in payroll but missing from offboarding tickets is an exception before any sample is drawn; and remember that annual and quarterly controls usually have every occurrence inspected, so a missed review cannot hide in a sample. In practice, incomplete populations cause more delays than failed samples.

Governance, risk, logical access and change management: the questions and the evidence

These questions are typical of service auditors in the common criteria areas; wording varies by firm, the evidence much less. Governance questions go to the person accountable for security; access and change questions go to the engineers who run the controls.

Operations, incidents, vendors, people and the optional categories

Availability and confidentiality questions appear only when those categories are in scope, a choice explained in our SOC 2 scope guide.

Preparing your people without scripting them

Examiners interview control operators because they reveal whether a control is real. A reviewer who cannot say what they looked for, or an engineer describing a deployment route the pipeline settings contradict, prompts deeper testing. Scripts make it worse: identical phrasing sounds rehearsed, and a scripted answer that does not match the records becomes a finding.

• Map each control to one owner. Each owner should know what the control is, how often it runs and where its evidence lives.
• Walk through a real item together. Take last month's leaver or change and trace it from start to finish in the actual tools. That is what the walkthrough will do.
• Agree how to answer an unknown. "I will check and come back to you" is a good answer. A guess is not.
• Keep one coordinator for requests. One person tracking each request and file avoids inconsistent submissions.

What not to do when the examiner asks for evidence

Some responses do more damage than the gap they try to cover. The CPA firm routinely checks metadata and timestamps, so repaired history is usually visible.

• Backdating approvals or reviews. A sign-off dated in March but created in September, according to the tool's audit trail, turns a single exception into a question about management's integrity.
• Creating evidence after the fact. Writing up a risk assessment, an incident review or training records once the request arrives does not show the control operated in the period. Disclose the gap and describe the remediation instead.
• Editing or filtering populations. Removing awkward items from an export is detected when the examiner reconciles it with the source system.
• Describing policy rather than practice. If the practice differs from the written policy, say so; the difference will surface in the samples anyway.

An accurate exception, explained with its cause and remediation, is something readers can weigh. How exceptions are reported is covered in SOC 2 exceptions and qualified opinions.

SOC 2 auditor questions: questions buyers ask