The SOC 2 examination: what happens in fieldwork, how sampling works, and what the evidence requests look like

What happens in a SOC 2 examination, and who takes part

In the examination, an independent CPA firm acting as service auditor gathers the evidence for its opinion on your controls, under the AICPA's attestation standards and against the Trust Services Criteria for the categories you chose. For a Type 1 it confirms, largely through walkthroughs, that the system description meets the description criteria and the controls are suitably designed as at one date. A Type 2 adds whether the controls operated effectively throughout the examination period, so most of its fieldwork is sampling.

An engagement partner answers for the opinion; a manager and senior associates run the fieldwork. On your side, a coordinator manages the requests, control owners evidence their controls, and a senior executive approves the assertion and signs the representation letter. Sterling prepares you, but the examining firm must be independent of that work, and only the firm issues the report.

The planning call, the request list and walkthroughs

The planning call

Fieldwork begins with a planning call, usually before the examination period closes. The firm and your coordinator confirm the system, categories and period, the treatment of subservice organisations, the control matrix, a contact for each area and the evidence portal. The firm reads the draft system description, governance and risk records and any earlier report first, because they show where to look.

The request list

The request list, often called the PBC (prepared by client) list, comes in two waves. The first asks for standing items such as policies, the organisation chart, configuration settings and vendor reviews, and for populations: complete lists of every occurrence of a control in the period, from joiners and leavers to production changes and incidents. The second follows once samples are drawn and asks for the evidence behind each selected item. Give every line an owner and a due date on day one.

Walkthroughs

In a walkthrough the control owner shows the examiner, usually on a shared screen, what triggers a control, who performs it, where it is recorded and what happens when it fails. The examiner follows one real instance end to end and watches the reports behind your populations being run, since a population proves nothing unless it is complete and accurate. The questions asked in each area, with the evidence that answers them, are in our guide to SOC 2 auditor questions.

How sampling works across the examination period

A Type 2 opinion covers the whole period, so the testing does too. For most manual controls the sequence is the same: you supply the population, the examiner checks its completeness against an independent source, such as repository history for deployments or payroll records for leavers, and then the examiner, never you, selects items spread from the first month to the last.

Sample sizes come from the firm's own methodology, not from the criteria, and depend on how often the control runs, the size of the population, the risk it addresses and what earlier testing found. An annual control is inspected at its single occurrence, a quarterly control has a large share of its occurrences inspected, and a control that runs hundreds of times is sampled at a far smaller proportion. Automated controls are handled differently: the examiner inspects the configuration and relies on your change management controls to show it stayed in place.

When a sample fails, the firm may widen its selection to judge whether the failure is isolated, one more reason to find weak controls before the period starts.

Evidence formats examiners accept, and the ones they send back

An owner's explanation is only a starting point; the examiner corroborates it by inspecting records, observing the control or re-performing it. Rejected evidence usually fails one of three tests: it cannot be traced to its source system, it is undated, or it was created after the event.

When a sample fails: handling exceptions during fieldwork

An exception is a sampled item that did not meet the control as described: access removed later than the policy allows, a change deployed without approval, a quarterly review that never happened. Firms usually raise each one as they find it. Answer quickly and factually: look for evidence held elsewhere, explain the cause, and say whether the failure is isolated and whether another control covered the risk. Never create a record now for an event in the period; later remediation belongs in management's response and does not erase the exception. How exceptions shape the opinion is covered in our guide to SOC 2 exceptions and qualified opinions.

The assertion, the representation letter, the draft report and the opinion

Management's assertion is your written statement, included in the report, that the description meets the description criteria and the controls were suitably designed and, for a Type 2, operated effectively throughout the period, giving reasonable assurance that your service commitments and system requirements were achieved. It must agree with the final description and with the test results.

The representation letter is not published. Signed by senior management and dated the same day as the report, it confirms that the firm was given every relevant record, that known deviations, incidents and any suspected fraud were disclosed, and that events after the period end were reported. The firm will not release the report without it.

The draft report then comes to you: the opinion, your assertion, the description and, for a Type 2, the tests performed and their results. Correct factual errors in your description and write management's responses to any exceptions; the tests, the results and the opinion, unqualified or qualified, remain the firm's. What customers receive between reports is covered in our guide to SOC 2 bridge letters, report validity and the annual cycle.

How long fieldwork takes: a week-by-week view

From the start of fieldwork to the issued report, five weeks to three months is a common range. A Type 1 sits at the short end, with no period to sample; a first Type 2 with several categories or slow answers sits at the long end. This calendar is illustrative for a first Type 2; each firm sets its own.

The SOC 2 examination: questions buyers ask