Can an internal auditor perform the SOC 2 audit?
No. The auditor who issues the SOC 2 report must be independent of your organisation. An internal auditor can do a lot of work before the audit: collect evidence, test controls and close gaps. The opinion itself must come from an external party. The AICPA describes SOC services as work offered by CPAs, and in the Netherlands an external IT auditor carries out the engagement. See SOC 2 in the Netherlands. You can hire or outsource an internal auditor to prepare, for example for a readiness assessment or for collecting evidence. The difference between preparing and assessing is the whole point of this page. If you are unsure whether a party is independent enough, ask your auditor. The rules are in the AICPA code and the Dutch professional rules (beroepsregels).
Many companies think their own auditor or compliance officer can sign the report. That is not possible, even if that person holds the title of auditor. A party that set up or manages the controls itself cannot assess them independently.
Why independence matters so much
A SOC 2 report exists because a customer wants to know that someone with nothing to gain has looked. If your own team assesses the controls it built, the report loses its value. A customer or an auditor sees that immediately.
Take a simple example. Your CTO set up the access control. Then your own internal auditor tests whether the access control works. The auditor is looking at a system that their boss built. That is not an independent test, even if the auditor is honest.
What you do internally
You do not have to outsource the whole audit. A lot of the work sits with you. A workable split:
| Task | Internal allowed | External required |
|---|---|---|
| Writing policies and procedures | Yes | No, but the auditor reviews them too |
| Collecting evidence (screenshots, logs, tickets) | Yes | No, the auditor checks the evidence |
| Testing internal controls before the audit | Yes, as preparation | No, the auditor tests independently |
| Closing gaps after a readiness assessment | Yes | No |
| The opinion on how the controls operate | No | Yes, by an independent auditor |
| Signing the SOC 2 report | No | Yes |
Collecting evidence is most of the work. You can read how this works in practice on the collecting evidence page. An internal team member who organises this well saves the auditor time. That lowers costs, see costs and timeline.
An example: an internal audit as preparation
A fictional example. A SaaS company with thirty employees has an internal compliance officer. A month before the external audit, they make a list of the ten most important controls. For each control, they look up the evidence: an export of the MFA settings, a ticket for the last access review, and a log entry for a change.
For three controls, the evidence is missing or not dated. The team fixes these before the auditor arrives. That is exactly the work of an internal party. The company leaves the opinion on whether those controls work to the external auditor.
The same compliance officer may not sign the report, and may not replace the auditor. They are the preparer, not the assessor.
How to separate the tasks
Good separation of duties prevents doubt about independence. Record it in a short note, so everyone knows who does what.
| Role | Does | Does not do |
|---|---|---|
| Internal compliance officer | Collects evidence, prepares controls, tests internally | Assess controls they designed themselves |
| Control owner (for example the CTO) | Sets up and maintains controls | Assess the evidence for their own control |
| External auditor | Tests independently and gives an opinion | Set up your controls for you |
| Management | Responsible for describing the system | Pressure the auditor over the outcome |
This table is a simplification. In a small organisation, roles often overlap. Then it is even more important to make the boundary explicit, and to ask the auditor whether that boundary is sufficient.
A checklist for your internal team
If you prepare internally, a fixed checklist helps. It stops you from forgetting something.
- Have the Trust Services Criteria you chose been translated into concrete controls?
- Does every control have an owner and a frequency?
- Is the evidence stored per control, with date and source?
- Is there a log of changes to your policies and procedures?
- Have the exceptions from the previous period been discussed and resolved?
- Do you have a list of subservice organisations and their reports?
This list is also useful for the readiness assessment. What you have already checked internally does not need to be repeated by the readiness party.
When should you bring in an external party for preparation?
Internal preparation is not always enough. A readiness assessment is a test before the formal audit. An external consultant, an internal auditor or a hired IT auditor can perform it. Make sure the party doing the readiness assessment is not also the later auditor, or ask the auditor to assess the independence.
One thing to watch. If the same party performs both the readiness assessment and the formal audit, you must have the independence carefully assessed. Some firms do this, see the readiness page. Ask the auditor explicitly what role they played in the preparation.
Common mistakes
Having your own audit department sign the report. An internal audit department is useful, but it cannot give the SOC 2 opinion.
Thinking “internal audit” and “external audit” are the same. An internal audit assesses for management. A SOC 2 audit assesses for the customer and is external.
Not recording the preparation. If you have checked something internally, keep the notes and the evidence. That helps the external auditor and avoids duplicate work.
Outsourcing too late. If you notice your internal people do not have the time, that is the moment to bring in external help. Do not wait until just before the audit. Each step needs its own time.
In short
Preparing internally is smart and cheaper. The opinion must come from outside. Keep those two things separate in your planning, your roles and your communication with customers, and your report will be strong.
More information
- The audit process: what the external auditor does and when
- Readiness assessment: ready for the audit or not?
- Collecting evidence: what auditors want to see per criterion
- The SOC 2 step-by-step plan: from zero to report
- What is SOC 2?: the main page of this section
Sources
- AICPA SOC services : the framework in which SOC services are offered
- Kiwa on ISAE and SOC reporting : ISAE 3000 for SOC 2 in the Netherlands