Where SOC 2 audits find gaps: the control areas to check first

SOC 2 gaps most often show up where a control exists on paper but the evidence does not: who had access, who approved a change, whether alerts were reviewed and how vendors were assessed. We have no published statistic on frequency, so this post maps the areas the criteria cover and shows how to test yourself in each.

What is a SOC 2 report, in one paragraph?

SOC 2 is one of the SOC services that a licensed CPA firm can provide on a service organization's controls. The AICPA sets the professional standards, and the criteria cover security, availability, processing integrity, confidentiality and privacy. Security, known as the common criteria, is the required base. A Type 1 report looks at design at a point in time. A Type 2 report tests operation over a period. Only the auditor can issue the report, and no tool can promise a result.

Which areas need the most evidence?

Secondary summaries of the criteria, which are the only text we could read without an AICPA login, group the common criteria like this. Check the AICPA's own document for exact wording.

Logical and physical access (CC6). This is described as the largest group. It covers provisioning, authentication, segmentation, physical access and data disposal. Tests you can run today: pick ten people who left in the last year and prove each account was removed, with a date. Pick ten current administrators and prove each is approved.

System operations (CC7). Vulnerability detection, monitoring, incident response and recovery. Ask whether alerts were reviewed, by whom and when. A dashboard nobody opens is not a control. Ask when you last exercised the incident plan and whether the notes exist.

Change management (CC8). Changes to infrastructure, data and software are authorized, designed, tested, approved and implemented. Sample ten production changes. For each, can you find the request, the review, the test result and the approval? Emergency changes are where the trail usually thins out, so include some.

Risk mitigation and vendors (CC9). Business disruption and third party risk. List your vendors that touch customer data, and show an assessment, a contract term and a review date for each.

Monitoring of controls (CC4). Ongoing evaluation of controls and remediation of deficiencies. If an internal check finds a gap, the fix and the date should be recorded.

Why do gaps appear in a Type 2 audit?

Because the auditor samples across the whole period. A control that worked in March but lapsed in July fails the sample. Access reviews done once, quarterly reviews skipped when a lead was away, and onboarding steps that depend on one person's memory are the typical shapes. These are failure modes from how sampling works, not measured rates.

Where does software supply chain fit?

Dependency and vulnerability work lands mostly in CC7 and CC8. An inventory of what you ship, a record of how findings were triaged and proof that updates went through review are all evidence an auditor can sample. Tooling can collect and organize that evidence. It does not certify you, and an auditor still decides.

What to do

1. Read the criteria in the AICPA document, then map each to a named owner.
2. Run the ten person access test and the ten change sample above this week.
3. Turn every recurring control into a calendar item with a place to store the proof.
4. Write down vendor assessments, even short ones, and date them.
5. Run a mock sample covering the full audit period, not just recent weeks.
6. Fix gaps and record the fix, because remediation records count as evidence.
7. Ask your auditor what format and sample sizes they will use.

Quick check

Sources

• AICPA SOC 2 overview
• AICPA 2017 Trust Services Criteria with revised points of focus
• Secondary summaries of the criteria groupings were used for the CC area descriptions and should be checked against the AICPA text.

Last reviewed: 18 October 2026.