A CPA firm's SOC 2 guide, updated on 14 October 2026, makes a point most first time teams learn the hard way: during a Type 2 observation period the auditor is not doing much, but you need to be, because "a control that's skipped one quarter is an exception in the report." The same guide says first year Type 2 reports often cover 3 to 6 months and that Type 2 observation periods typically run 3 to 12 months.
The AICPA has not issued a SOC 2 checklist, so the calendar below is a template I wrote from the criteria groups in that guide. Adjust it to your own control descriptions. It assumes nothing about tooling.
What's affected
Every recurring control you describe to the auditor. If your policy says "quarterly access review," the auditor will look for one in each quarter of the period. If it says "monthly," they will look for each month.
How to check if you're exposed
Open your controls list and mark each control with its frequency. Then ask: for the last full period, where would I find proof it ran? If the answer is a person's memory, it is not proof.
The calendar
| Cadence | Task | Owner | Save as evidence |
|---|---|---|---|
| Per event | New hire access request and approval | Hiring manager | Ticket with approver and date |
| Per event | Termination access removal | IT or people ops | HR date plus deactivation timestamp for each system |
| Per event | Production change approval | Engineering | Merged pull request with reviewer and passing checks |
| Per event | Incident record | Incident lead | Ticket, timeline, follow up actions |
| Weekly | Vulnerability scan results triage | Security or engineering lead | Scan output and tickets with severity and due date |
| Monthly | Review of alerts and logging coverage | Engineering lead | Dated note or ticket |
| Monthly | Reconcile HR roster to identity provider | IT | Diff output and removals |
| Quarterly | User access review for in scope systems | System owners and managers | Access lists, reviewer, decisions, removal confirmation |
| Quarterly | Backup restore test | Engineering | Test record with result |
| Quarterly | Vendor register review | Security or operations | Updated register with review dates |
| Annual | Risk assessment | Leadership | Rated risks with owners and treatments |
| Annual | Policy review and approval | Policy owners | Version history, approver, date |
| Annual | Security awareness training | Everyone | Completion report |
| Annual | Penetration test and retest | Engineering | Report, findings tracked to resolution |
| Annual | Incident response exercise | Incident lead | Notes and actions |
| Annual | Vendor SOC report review for critical vendors | Security or operations | Dated review note per vendor |
The risk assessment, penetration test, incident exercise, and vendor review items trace to the CPA firm's descriptions of CC3, CC4, CC7 and CC9. The change approval item traces to CC8. Frequencies are examples. Your policy sets them.
What to do now
- Copy the table into a sheet or tracker and replace owners with real names.
- Create recurring calendar events or tickets for each row, due a week before the deadline you promised in your policy.
- Decide where each artifact is stored and name files with date and control, such as 2026-Q4-access-review-github.csv.
- For population based controls (hires, leavers, changes), make it possible to produce the full list for the period on demand. The CPA firm says auditors request the full list and then select samples.
- Hold a 20 minute monthly check where owners confirm their tasks ran.
- At the end of each quarter, do a dry run: pretend you are the auditor and try to pull one sample per control.
How to avoid this trap
- Do not write frequencies in policies that you cannot sustain. Weekly on paper and monthly in practice is an exception.
- Do not store evidence in individual inboxes.
- Do not let owners self attest without an artifact. A date and a tick box in a chat is weak.
- Do not forget the end of the period. Leavers, vendors and changes in the last weeks get sampled too.
- Do not run controls only in the last month before fieldwork. Auditors can see dates.
Why it matters
The calendar is the difference between a three week fieldwork and a three month scramble. It also reveals which controls are unrealistic before they become exceptions. Dropping or loosening a control before the period starts is normal. Doing it after is a finding.
Try it yourself
Pick one quarterly row, say the access review, and do it today for one system. Save the artifact, then answer: could someone who does not work here understand it in two minutes?
Click through it at your own pace, or open it full screen.
Quick check
How do auditors usually test controls such as new hires or production changes?
They request the full population for the period and select samples from it.
Is there an official AICPA SOC 2 checklist?
No. The AICPA issues the criteria and points of focus. Controls and checklists are designed by each organization and its auditor.
