Common Roadblocks to Completing a SOC 2 Audit

Author: Joseph Kirkpatrick is the President of Kirkpatrick Price

A SOC 2 report helps enterprises to demonstrate they take security and privacy seriously. Enterprise leaders can expect prospective customers to ask about SOC 2 compliance their organization stores or processes data on behalf of other companies. It’s a rite of passage for startups and established businesses transitioning to larger clients.

Without having been through the SOC 2 audit process, it’s difficult to know where to start. In an ideal world, an organization has its controls in place and its documentation ready. If so, the audit process is relatively painless. However, many enterprises experience roadblocks that delay auditing or prevent their auditor from issuing a report.

In this article, let’s look at the six most common SOC 2 roadblocks. If CISOs understand what can go wrong, they can avoid the pitfalls that disrupt auditing, ensuring that they get SOC 2 reports as quickly as possible.

Lack of Organizational Buy-In

During a SOC 2 audit, the auditor asks CISOs to supply documentation about controls and risk management alongside other information. Managers and employees responsible for gathering that information and writing documentation may consider it a distraction from their core responsibilities.

For example, sales executives often instigate SOC 2 audits. They are responding to potential customers who want the reassurance a SOC 2 report provides. But the sales team, who understand the need for an audit, is not responsible for implementing SOC 2 controls or gathering data. Those who are responsible may not understand the audit’s purpose or be motivated to cooperate fully.

Without executive and organizational buy-in, audits take longer and, in the worst cases, remain incomplete. Before embarking on an audit, enterprise leaders should educate managers and staff about the importance of audits to achieving the business’s objectives.

Also Read: Unsecured Kubernetes Instances Vulnerable to Exploitation

The SOC 2 Audit is Improperly Scoped

Correct scoping is critical to an audit’s success. The SOC 2 auditing process is based on Trust Services Criteria, which are divided into five categories: security, privacy, process integrity, confidentiality, and availability. The first step is selecting the criteria that apply to an organization’s business’s services. Once the CISOs have chosen appropriate criteria, they can determine which systems, controls, and policies support them.

The audit scope also determines which systems will be audited. For example, it includes the locations involved in the audit, the applications and platforms, and whether third parties are involved in providing a service.

This is the information an auditor will use to shape the auditing process, so they must answer detailed questions about the relevant systems and controls. If they scope too broadly, their organization may struggle to meet the criteria and significantly increase the work involved in securing a report. If scope too narrowly, potential customers may find the SOC 2 report insufficient for vendor risk assessments. A good auditor will guide the CISOs through the process of correctly scoping your audit.

Inadequate Documentation

Can CISOs business supply documentation for all controls that fall under the audit’s scope? Systems and controls are assessed based on the documentation you provide. This is the most important type of evidence available to auditors, and gaps in documentation may be considered gaps in their controls. If the organization has put in the work to develop controls, it would be unfortunate to fail an audit because CISOs didn’t adequately document the work.

Lack of SOC 2 Readiness

SOC 2 readiness aims to overcome the roadblocks mentioned in the previous section. Before embarking on an audit, an organization should ensure it is in a good position to complete it. That means:

• It understands which controls will be examined during the audit;
• It has implemented those controls and is aware of controls that may be missing; and
• It has assessed its documentation and, where necessary, created new documentation for relevant controls.

Completing a basic readiness assessment increases the likelihood of a frictionless auditing process, avoiding control gaps and potential failures. If an enterprise is ready, it has controls in place and can supply the documentation the auditor expects.

Incomplete Risk Assessments

Inadequate or incomplete risk assessments are one of the most common causes of delayed SOC 2 examinations. Organizations undergoing SOC 2 audits are required to perform a risk assessment for relevant Trust Services Criteria.

A risk assessment determines whether implementing controls as stated in the previous section adequately mitigate risk. They should be carried out annually or when a system changes significantly. Before embarking on a SOC 2 audit, ensure that risk assessments for the relevant controls are complete and up-to-date.

Also Read: Strategies to Finding the Right Security Partner for the Enterprise

Choosing the Wrong SOC 2 CPA Firm

Only a Certified Public Accountant (CPA) or a licensed CPA company can issue a SOC 2 report. Although IT leaders may come across services that claim to automate SOC 2 audits, the most they can do is help them prepare. The audit must be carried out and the report must be written by a qualified CPA with information security experience. However, other professionals with relevant expertise may be involved in the auditing process.

It’s unnecessary to engage one of the big four accountancy firms, but IT leaders should consider CPA firms with an established reputation. When assessing a CPA’s suitability, ask about their data security, IT governance, and regulatory compliance experience. CPAs who specialize in the field may have additional qualifications, including Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), and Certified in Risk and Information Systems Control (CRISC).

IT leaders must ensure that they have implemented and documented the relevant controls for the SOC 2 Trust Services Criteria. Doing so will eliminate delays and ensure a fast audit process.