Questions to ask your SOC 2 auditor at kickoff

At kickoff, ask your SOC 2 auditor how they will scope the system, what evidence they expect, how they sample, what the timeline looks like, and how the report will read. Get answers in writing. Most delays come from assumptions nobody checked at the start.

Scope and criteria

• Which categories do you recommend for our customers, and why?
• How do you want the system boundary drawn?
• Which vendors will be carved out and which included?
• Do you expect any criteria to be marked not applicable? What reason do you need?

Timeline

• For a Type 1, what is the audit date and how long is fieldwork?
• For a Type 2, how long must the period be for a first report, and can it start on a date we choose?
• When do you need the system description draft?
• What happens if a control changes mid period?

See choosing the length of an observation window.

Evidence and sampling

• Do you provide a request list up front?
• How do you choose samples, and how many per control?
• Which controls need full populations?
• What export formats and sources do you prefer?
• Do you test completeness of our reports? How?

Specific controls where expectations vary

• Do you expect a penetration test, and how often? See is a pen test required.
• What do you expect for vulnerability scanning cadence?
• How do you view training and background check timing?
• What is acceptable evidence for a very small team with limited segregation of duties?

Communication and issues

• Will you tell us about exceptions as they appear, or only at the end?
• What is the process for management responses?
• Who is our day to day contact, and what is the response time?
• How do you handle disagreements about whether a control meets a criterion?

Report and distribution

• What will the opinion section say if there are exceptions?
• Who may receive the report, and what are the use restrictions in your engagement?
• Can we get a bridge letter, and when?
• How do you handle renewal and the gap between periods?

Commercial and independence

• What is in the fee and what is extra, such as re testing or scope changes?
• If you or an affiliate helped with readiness work, how is independence handled?
• Can we talk to a reference customer of similar size?

Capture the answers

Write a one page summary after the call and send it back for confirmation. It becomes your reference when the plan shifts. For picking the firm itself, see how to choose a SOC 2 auditor.

Quick check

Last reviewed: 19 October 2026.