Questions, boundaries and records: can your SOC 2 auditor help you get ready without compromising independence?

One reply says the auditor should never be the consultant. Another says readiness work is a permitted service. Practitioners are regularly debating this conflict on Reddit. We listen to these discussions to share what is being talked about and to add to the conversation. This piece does not rule on what any professional body permits. It gives UK companies serving US customers the questions to put to an auditor, the line between assessing and implementing and the decisions to record.

SOC 2 is an attestation framework from the AICPA, the American Institute of CPAs. No UK law requires it. UK companies meet it when US customers ask for a report, and an independent service auditor issues that report.

Why practitioners disagree about SOC 2 readiness work

Both positions in the discussion can be partly right because the word readiness covers very different work. A readiness assessment finds gaps against the Trust Services Criteria, the AICPA's standards for SOC 2. Readiness help can also mean writing policies, configuring systems or running controls on the company's behalf. The first looks like assessment. The second looks like implementation.

Independence is the auditor's freedom from relationships and interests that could compromise objectivity. Whether a particular readiness service is acceptable depends on the audit firm's own independence policies and the professional standards it follows. The reliable approach is to ask the firm to name the standard, describe the service in writing and state its safeguards.

The line between assessing and implementing

Assessing: finding gaps and explaining the criteria

Assessing means comparing the company's controls with the criteria and reporting what is missing or weak. It also covers explaining what a criterion means. The output is a finding. The company decides what, if anything, to do about it.

Implementing: designing, building and running controls

Implementing means choosing the control, writing the policy, configuring the access setting or operating the review. The output is a working control. The judgement inside it belongs to whoever made it. If the auditor made it, the auditor would later be testing its own work. This is the self-review problem, and it is the reason the question matters.

The grey zone: templates, advice and review of drafts

Templates, general advice and comments on a draft policy sit between the two. A practical test is whose judgement ends up in the control. If management reads the advice, decides and writes the control in its own terms, management has implemented it. If the adviser's text is adopted unchanged, the adviser has. Put the grey-zone services to the audit firm explicitly and record the answer.

Questions to put to a SOC 2 auditor before you engage

Ask these in writing and file the replies:

  • Which independence requirements does the firm apply to this engagement, and can it cite them?
  • Does the firm offer readiness services, and if so, which exactly?
  • Will different teams deliver readiness work and the examination?
  • Will the firm write policies, configure systems or run controls for the company?
  • What safeguards apply if any readiness work is done, such as separate review?
  • Will the boundary be stated in the engagement letter?
  • If another firm does the readiness work, how will findings be handed over?

A firm that answers clearly and in writing makes the later record easier. A firm that avoids them has still given an answer.

Decisions to record and the patterns that call for them

These five patterns are places where a missing record becomes a problem later. Each row pairs the pattern with what to file.

What practitioners find What to record What it protects
One firm quotes for readiness work and the examination in the same proposal File the firm's written statement of which team does which work and which safeguards apply A clear answer if a customer asks how independence was handled
A consultant drafts the policies and management signs them without edits Record that management reviewed, changed and approved each policy, with the approver named Visible management ownership of the controls
The people who found the gaps also fix them Record who assessed, who remediated and the date of the handover between the two A dated line between assessing and implementing
Independence assurances were given on a call Get the position in writing, in the engagement letter or a confirmation email, and file it A commitment that can be found later
A control operates but nobody can say who owns it Name an internal control owner for every control Evidence that management runs its own controls

How audit independence is protected when readiness work is involved

Protection comes from three things: a boundary that is defined before work starts, management decisions that are visibly management's and records that show both. Safeguards a company can ask the audit firm to describe include separate teams for readiness and examination, review by someone outside the engagement and written confirmation of the boundary.

Audit firms keep their own record of quality decisions and sign-offs. Ideagen's page on how audit firms document audit quality decisions and sign-offs under ISQM 1 and QC 1000 shows how that record is kept. The company needs the matching record on its side.

Keep an evidence trail of the boundary. A simple boundary register holds one row per service with the date, the provider, whether the work was assessing or implementing, the management owner and where the written confirmation is filed. Store the engagement letters, the confirmation emails and notes of any meeting where the line was discussed. Keep dated drafts that show management's changes to policies. Together these answer a customer who asks how independence was handled.

What to look for in internal audit quality assurance software in the UK

Internal audit quality assurance is the set of checks showing that audits meet the standard the function has set itself. Software should record independence and conflict declarations for each engagement and capture reviewer sign-offs with dates. It should keep version history of audit documents and track findings through to closure. It should also let a user export the full record of an engagement on request.

Ask in writing, separate the roles and keep the record

Whether a SOC 2 auditor can help with readiness is the wrong first question. The better ones are what the help consists of, who exercises the judgement and what record shows it. Put the questions in writing, keep assessing and implementing apart and file the answers. Then the position can be shown to any customer that asks.

Readers who want to continue the discussion can join practitioners in Ideagen's Reddit community.