SOC 2 Type II evidence: the controls auditors test and what proof costs

A control that operated leaves a dated document

SOC 2 is an attestation engagement an independent CPA firm performs against the AICPA's Trust Services Criteria, and the Security criterion is mandatory in every report. The criteria describe control activities a service organisation should run, among them logical access, change management, risk assessment, monitoring and vendor oversight. The report is not a certification, and Security is only the first of five criteria a buyer may ask about.

A Type I report covers the design of those controls as of a single date. A Type II report covers design and operating effectiveness across an observation window, and the window is why the engagement is hard. An access review that happened is not evidence. A review that is signed, dated and inside the period, showing who reviewed whose access, what exceptions surfaced and how each was resolved, is evidence. That distinction explains most findings: the control is designed correctly and written into a policy, but nobody can produce the artefact showing a person executed it on the date the policy required, inside the period the report covers.

The window is a work multiplier

Type II is what enterprise buyers and their own auditors ask for, because it speaks to how controls behaved over time rather than how they were described on one day. The window is normally 12 months for a repeat engagement and can be shorter for a first report, which is a legitimate way to reach the market sooner. Nine months is a common compromise because it still spans three quarters.

Window length multiplies the evidence, not the fee alone. A quarterly control inside a 12-month window needs four instances, each with its own signed record. Cut the window to six months and it needs two, and the report also expires sooner and covers less. The arithmetic is worth putting in front of a buyer: a shorter report is cheaper to produce and weaker to rely on, and the buyer's auditor knows which one they are reading.

Five controls produce most findings

Findings cluster where a human has to produce a dated artefact. Access reviews, change management for pipelines that deploy without a ticket, monitoring nobody can prove was watched, subprocessor oversight, and restores that were never attempted are the recurring five. The table maps each to the evidence that satisfies it and the failure that turns it into a finding.

What continuous evidence costs

The cost of an audit is proportional to how much of it is done in the final month. Two habits remove most of that cost. Give exactly one named owner per control, not a team, and make collection continuous so the evidence exists before anyone thinks about the audit. Automate the export, not the judgement.

AWS Config is the cheapest published example. Continuous recording costs $0.003 per configuration item per region a month; periodic recording costs $0.012; rule evaluations are $0.001 each. A 40-account estate with 500 continuously recorded items in each of two regions carries 40,000 items and pays $120 a month, before any rule evaluations. That is a small line against the cost of reconstructing a quarter from screenshots.

The trade-off is scope. AWS Audit Manager automates evidence collection into audit-ready reports with prebuilt frameworks including SOC 2, and it is closed to new customers, so a new adopter assembles the same result from Config, CloudTrail and its own tooling. Pipeline approval gates are a paid feature elsewhere: GitLab's deployment approvals, which block a deployment until required approvals are recorded, sit in Premium and Ultimate. A small team on the free tier satisfies the control with pipeline configuration and merge request records instead, which is weaker evidence and costs nothing.

Three objections, and what they cost

The first is that a compliance tool will make the audit fast. The AICPA's own members have warned against that framing. Sean Linton, who chairs the AICPA Assurance Services Executive Committee's SOC 2 working group, said professionals are seeing indications that fast and easy may come at the expense of quality and objectivity. A report that reads as purchased rather than tested will not survive a customer's vendor review, whatever it cost.

The second is that the policy can be updated to fit the window. A policy revised before the period proves nothing about the period. If the change management standard was last revised before the window opened, the auditor needs the revision that was in force during the window, plus evidence the current version is reviewed at the required cadence. Pre-dating a document turns an administrative gap into a credibility problem with the engagement team.

The third is that a Type I report is enough to start selling. It is enough for a buyer who accepts a point-in-time opinion, and not enough for one whose own auditor asks what happened across the year. The two reports answer different questions, and the price difference is not the reason to choose between them.

The decision rule before the window opens

Choose a nine-month first window if a deal is waiting and the controls have run for at least two quarters; it spans three quarter-ends and reaches the market sooner. Choose 12 months if the buyer is an enterprise whose own audit calendar expects a full year, because a shorter report invites a second round of questions you will answer anyway.

Walk every control backwards from the artefact before the window opens. Name the document, the system that produces it and the person who signs it, then check that the last two instances exist and are dated inside the period. Anything missing is cheap to fix before the window and expensive to explain inside it. Reconcile scope at the same time: the systems, vendors and subprocessors in the description have to match what the auditor will test, and a service added mid-period needs to be brought in or explicitly excluded with a reason.

Then read your own report the way a buyer will. The opinion, the period, the systems in scope and the exceptions are the four things that decide whether it is evidence for someone else's risk file. A badge on a trust page is none of them.