SOC 2 readiness assessment: know where you stand before the audit
A readiness assessment is a pre-audit. Someone goes through your controls, checks your documentation and flags where the gaps are, before the official auditor does. It sounds like an extra step, but it costs less than findings in your final report. The AICPA does not require a readiness assessment, but almost every serious SOC 2 step-by-step plan includes it as step nine, just before the official audit.
Findings from a readiness assessment are confidential. They do not appear in your report. Findings from the official audit do. Your clients see those. That is the main argument for a readiness assessment.
What is the difference from a gap analysis?
Both check whether you are ready, but they happen at a different point in the process and have a different purpose. You can do the preparation in-house, but the verdict of the audit itself comes from an external party. Read why on internal auditor and SOC 2.
| Gap analysis | Readiness assessment | |
|---|---|---|
| When | At the start of the process | Four to six weeks before the official audit |
| Purpose | Determine what you still need to build | Verify that you have built it correctly |
| Depth | Inventory | Testing (just like a real audit) |
| Output | Action plan and roadmap | Go/no-go advice and list of points |
| Who does it | You or a consultant | A consultant or your auditor |
| Cost | €1,000 - €5,000 | €2,000 - €8,000 |
The gap analysis says: “You are missing access reviews and an incident response plan.” The readiness assessment says: “Your access reviews are documented, but the timestamps do not match your policy, and your incident response plan has not been tested.”
What is tested during a readiness assessment?
It is a compact version of the real audit. A consultant goes through the Trust Services Criteria that fall within your scope and checks four things per control:
- Does the control exist (policy, configuration)?
- Is the evidence demonstrably present?
- Does the evidence match what the policy says?
- Is there continuity over the observation period (for Type II)?
Concrete examples of what comes up:
- “Your policy says offboarding takes place within 24 hours, but in two of the five cases we tested it took three days.”
- “Your vulnerability scanner runs weekly, but there are no follow-up notes on the high-severity findings from April.”
- “Your annual security awareness training cannot be demonstrated for three employees who joined in December.”
An auditor would also find all of these. Now you can fix them.
Do it yourself or outsource?
You can carry out a readiness assessment in-house. That brings no external costs, but it requires honesty with yourself, which is harder than it sounds.
Doing it yourself works when:
- You know the Trust Services Criteria well
- You have been through an audit before (as an auditor or as the audited party)
- You can step back far enough from your own work
- Your team is small enough to go through all controls in two to three days
Outsourcing to a consultant works better when:
- This is your first SOC 2
- You want someone with an auditor’s eye to look at your documentation
- You are unsure about specific controls or the adequacy of your evidence
- Your auditor carries out the readiness assessment themselves (this links the findings directly to the audit process)
Some CPA firms carry out the readiness assessment as part of the audit contract. This can be advantageous because the consultant then knows exactly what the auditor will check. The downside: you miss the independent second opinion.
What does a readiness assessment deliver?
The deliverables are not standardised. Every consultant works differently. At a minimum, you can expect:
A findings overview Per control: status (meets, partly meets, does not meet), explanation and recommendation. Some reports also prioritise findings: critical, high, low.
A go/no-go recommendation Can you start the official audit in four weeks, or are there structural gaps that need more time? Sometimes the answer is: “Postpone the audit by two months and fix X and Y first.”
An action list What you need to do, in what order, and how much time it takes. A good consultant is specific: not “improve your access policy” but “add a timestamp and approval signature to the access review template in Google Drive.”
When is a readiness assessment not useful?
If you already have ISO 27001 and your controls have been running stably for two years, an extensive readiness assessment is less necessary. You already know how it works. In that case, an internal check of the SOC 2-specific requirements is enough.
Also, if the budget is really tight and you are doing a simple Type I audit with a small scope, you can swap the readiness costs for extra preparation on your own.
But 70% of companies that skip a readiness assessment get unexpected findings during the official audit. That €4,000 for a readiness assessment would have been cheaper than the delay, extra audit days and management response that findings bring with them.
The readiness assessment in the step-by-step plan
The readiness assessment falls between step 8 (choosing an auditor) and step 10 (the official audit) of the SOC 2 step-by-step plan. The sooner you know the findings, the more time you have to fix them before the audit clock starts.
The ideal timing: four to six weeks before the planned start date of the official audit. That gives you room to resolve findings without disrupting the audit planning.
Also read the page about the audit process to understand exactly what an auditor tests, so you know what a readiness assessment prepares you for.
More information
- Step-by-step plan – The readiness assessment falls in step 9 of the full process
- The audit process – What the auditor will do after the readiness assessment
- Collecting evidence – What auditors want to see per criterion
- Costs and timeline – The readiness assessment as part of the total investment
- AICPA SOC 2 – Official source