A SOC 2 report is an assurance report issued by a licensed CPA firm that tests your controls. For a VP of engineering, the job is to set a scope that matches reality, make evidence a by-product of normal work, and choose an auditor with care. Shortcuts show up in the report.
What is SOC 2, and who issues it?
The AICPA describes System and Organization Controls as a suite of service offerings that CPAs may provide on system level controls of a service organization. The reports give users information to assess risks of outsourcing services. The AICPA sets the professional standards for these engagements.
Those words matter. The audit is performed by a CPA, not by a software tool. The AICPA has been public in 2026 about its concerns over fast, easy offerings, with articles on the risks of quick turn engagements and a notice that it is looking into allegations about a compliance vendor's SOC business practices. The institute stresses that SOC services should be thoroughly evaluated by service organizations and CPA firms.
What should you do about that?
Treat auditor selection as an engineering risk. Customers may read your report closely, and a weak one can fail in a procurement review. Ask a prospective auditor who will perform the work, whether the firm is licensed and enrolled in peer review, how testing is done and what they expect from your team. Cheap and instant should raise questions, not excitement.
What does the audit ask of engineering?
You choose the scope and the criteria with the auditor, and then the auditor tests whether your stated controls operate. For engineering, the evidence usually comes from a handful of places.
- Source control: branch protection, required reviews, who can merge.
- CI and deployment: proof that production changes come through the pipeline.
- Access: a list of who has production access and how it was approved and removed.
- Monitoring and incident handling: alerts, tickets, post incident reviews.
- Vulnerability management: scans and the record of what was fixed and when.
- Vendor management: how you assess the providers you rely on.
Constructed example: your policy says every production change has a reviewed pull request. The auditor samples twenty changes from the period. If two were pushed directly by an admin during an outage, that is an exception to explain, and the useful answer is a documented emergency change process, not a retroactive edit.
What is the difference between types of report?
A Type I report describes whether controls are suitably designed at a point in time, and a Type II report also tests whether they operated over a period. Ask your auditor to confirm the definitions and what a first report should be, since customers differ in what they accept.
Where do tools fit?
Compliance automation can collect evidence from systems and keep it in one place. It cannot decide your scope, and it cannot issue the report. For software specific evidence, Safeguard can generate SBOMs and scan dependencies, and its compliance automation can help organize the evidence. Safeguard is not a CPA firm, and using it does not give you a SOC 2 report.
What to do
- Decide the system in scope and the criteria with your auditor, in writing.
- Interview at least two firms and check licensing and peer review.
- Make branch protection, required reviews and pipeline only deploys the default.
- Run access reviews on a calendar and keep the output.
- Define an emergency change path so exceptions are explainable.
- Choose Type I or Type II with your auditor and customers in mind.
Quick check
Can software produce my SOC 2 report?
No. A licensed CPA firm issues SOC 2 reports after testing. Tools can help collect evidence.
Why does the AICPA warn about fast SOC 2 offers?
Its 2026 notices and articles describe risks of quick turn engagements and urge careful evaluation of SOC services by service organizations and CPA firms.
Sources
Last reviewed: 18 October 2026.
