SOC 2 readiness: The control gaps auditors flag first

You are a compliance manager or infosec lead, three months into your first SOC 2 audit window, and your controls just passed a design review. Everything is set: the policies are current, and the risk register has an assigned owner. Then an auditor pulls a sample of access reviews from the third quarter, and your team realizes no one exported the results. The control operated, but the evidence was never captured.

This scenario is so common that the failure points are predictable. Auditors flag gaps in the evidence trail: missing documentation, skipped review cycles, or ownership that was assumed but never recorded. The problem compounds in a Type 2 engagement, where the auditor evaluates operating effectiveness over an observation period of three to 12 months, not at a single point in time.

Most first-time findings can be traced back to six recurring gaps:

1. Access management
2. Change management
3. Risk assessment
4. Vendor oversight
5. Incident response
6. Evidence consistency over the audit period

This guide covers each gap and the evidence it requires. Under the AICPA’s Trust Services Criteria, having a policy in place isn’t enough. Your team must produce documented evidence that the control operated as designed across the audit window.

Gap 1: Access management without a continuous trail

Access control gaps are among the most frequently cited findings in first-time SOC 2 audits. The AICPA’s Common Criteria map these controls in CC6.1 through CC6.3, which cover logical access security, user provisioning, and user deprovisioning. While the control itself may exist, the documentation proving it operated on a consistent schedule is missing.

Where this breaks down:

• Former employees with access: Offboarded employees retain system access past their termination date because revocation is manual and no one tracks the lag.
• One-time reviews: An audit deadline approaches and access reviews happen once to check a box, instead of on a documented recurring schedule.
• Undocumented authorization: Privileged accounts lack approval records showing who authorized the access and when.

What auditors pull in sampling:

Auditors request access review exports from the identity provider or access management system, run quarterly (or more frequently), which each include the reviewer name and completion date. They match termination tickets against access revocation timestamps to confirm revocation happened within the defined SLA. They also pull approval records for every privileged account granted during the audit period, including the business justification. Samples are then drawn across the full window, so a single review conducted in the final month will not satisfy the requirement.

Gap 2: Change management missing approval and testing records

Every production change needs a documented trail connecting the request, the approval, the test, and the deployment. Gaps appear when teams move fast and skip documentation, especially for hotfixes, infrastructure-as-code deployments that bypass the ticketing system, and changes classified as low-risk.

What auditors pull in sampling:

Auditors gather tickets for every production change made during the audit period and look for change tickets with documented approval from an authorized reviewer and test results confirming the change did not introduce new risks. Emergency changes are not exempt. If an emergency change bypasses the standard approval path, the organization still needs a documented fast-track process that captures who approved it, what was changed, and what testing followed. Any change without a documented audit trail creates an automatic finding, regardless of urgency.

Gap 3: Risk assessments that are not repeated or acted on

A one-time risk assessment may satisfy a point-in-time review in a SOC 2 Type 1 audit. It will not satisfy a Type 2 audit, which expects risk assessment to be a recurring process that drives remediation. Read additional details about the key differences between SOC 2 Type 1 and Type 2 audits here.

Where this breaks down:

• A one-time risk register: The risk register was created at program launch and never updated to reflect new vendors, product launches, or infrastructure changes.
• Undocumented risk: Identified risks have no assigned owner, no remediation deadline, and no evidence of closure.
• Untracked emerging risks: New risks introduced during the audit period go unrecorded because no reassessment process exists.

What auditors pull in sampling:

Auditors request the current risk register with entries that reflect the actual environment during the audit period, and documentation of at least one formal reassessment conducted during that period. They also seek remediation records showing that identified risks were tracked through closure, with assigned owners and documented dates. A register full of open items with no documented progress reads as a control that only exists on paper, and it may fail to meet audit requirements.

Gap 4: Third-party risk left unmonitored after onboarding

Vendors introduce risk when they access, store, or process customer data. This risk profile shifts over time, as auditors examine how companies monitor vendors after the contract is signed, not solely during onboarding. For SOC 2 purposes, the distinction between subservice organizations under the carve-out method versus the inclusive method determines how deeply vendor controls factor into the audit scope. Many first-time companies misclassify this, which creates scope gaps the auditor will identify.

Where this breaks down:

• One-time vendor vetting: Vendor risk assessments happen at onboarding and are never repeated.
• Uncollected compliance reports: No process exists for collecting and reviewing vendor SOC 2 reports on a schedule.
• No risk tiers: Critical vendors lack a documented risk tier that determines review frequency.

What auditors pull in sampling:

Auditors review vendor inventory to confirm that vendors have assigned risk tiers based on data access and criticality. They look for documented reassessments of high-risk vendors during the audit period. Quarterly reviews are a defensible cadence for critical vendors, while annual reviews may be appropriate for lower-risk vendors. Auditors also look for records showing that vendor compliance reports, such as their own SOC 2 reports, ISO 27001certification, or equivalent documentation, were reviewed and assessed.

Gap 5: Incident response plans that were never tested

An incident response plan is essential, but having one isn’t enough. Auditors look for evidence that teams have tested the plan through simulations before a real incident puts it to the test.

What auditors pull in sampling:

Auditors look for a documented incident response plan covering detection, escalation, containment, and communication. Records from at least one tabletop exercise or simulated incident conducted during the audit period, including participants, scenario, and findings can meet this requirement. If an actual incident occurred, auditors need a full timeline from detection through resolution, including root cause analysis and documented lessons learned.

Gap 6: Evidence that does not cover the full audit period

This gap is specific to Type 2 engagements, and it is the one companies new to the process underestimate most. Type 2 evidence must demonstrate operating effectiveness across the entire review window, which can span three to 12 months. A single sample pulled the week before fieldwork will not meet that standard.

Where this breaks down:

• Backdated evidence: Evidence is gathered retroactively and backdated, which auditors can identify by metadata patterns and timestamp clustering.
• Clustered sampling: Samples concentrate near the end of the period instead of distributing across it.
• Undocumented control changes: Controls that changed mid-period lack documentation explaining the change, the date, and the reason.

What auditors pull in sampling:

Auditors gather evidence samples distributed across the full audit window, with enough frequency to demonstrate consistency. If a control changed partway through the period, the change date, the business reason, and evidence from both before and after the update must be documented. Auditors test for consistency of operation, and a documented improvement mid-period is viewed more favorably than an undocumented inconsistency.

Closing gaps before fieldwork starts

Manual evidence tracking can work for a small company preparing for a point-in-time report. However, it breaks down for any organization managing an extended audit window, multiple framework mappings, or a growing vendor inventory.

Moving from static spreadsheets to a connected system that links controls, evidence, and owners is what matters most. Optro centralizes audit, risk, infosec, and compliance work as a connected system of action, so compliance teams can map controls across frameworks and automate evidence collection on the schedule auditors expect. Teams using Optro have reported marked improvement in engagement and evidence collection efficiency, redirecting that time toward risk analysis instead of evidence retrieval.

Start by mapping current controls against these six areas. Identify where evidence may exist in a team member’s memory or inbox, then build the recurring collection process that captures proof of control operation as it happens. The goal is for the fieldwork to confirm what the evidence already shows.

Optro automates SOC 2 evidence collection

See it in action