For SOC 2 Type 2, keep dated proof for every hire, role change and leaver in the audit period: an approved access request, a completed background check where your policy requires one, signed policies, finished training, and a timestamped removal of access. The auditor tests real people, so gaps in any one record count.
Why do auditors test people and not just policies?
A Type 2 report covers a period of time and includes tests of operating effectiveness. A policy that says "access is removed promptly" proves nothing alone. The auditor picks named employees from your HR list and asks for the trail behind each one.
Three groups of criteria touch the employee lifecycle. CC1.4 and CC1.5 cover competence and accountability, which is where background checks, job responsibilities and policy acknowledgments live. CC2.2 covers internal communication of responsibilities, which is where security awareness training sits. CC6.2 and CC6.3 cover granting, changing and removing access.
What does a good onboarding record look like?
Build one folder or ticket per hire. It should answer five questions with a date on each answer.
- Who approved the access, and was it based on the role? (CC6.2)
- When was the background check done, if your policy requires one, and was it before production access?
- When did the person sign the acceptable use and security policies?
- When did they finish security training, and was that within the window your policy states?
- Which accounts were created, and do they match the access request?
The date comparison is the whole test. A policy that says training within 30 days of start fails when the record shows day 41. Set the window you can actually meet, then meet it.
What about role changes and contractors?
Auditors read CC6.3 as three verbs: authorize, modify, remove. Teams remember the first and last and forget "modify." When someone moves from support to engineering, the old access should be reviewed and removed, and the review should leave a record.
Contractors and temporary staff are in scope if they touch in scope systems. Give them the same ticket, the same policy acknowledgment and a hard end date in the identity system.
What does offboarding evidence need?
For each leaver, keep the last working day, the time access was removed from your identity provider, and the time it was removed from each system that does not use single sign on. Note the device return or wipe, and any shared secrets that were rotated.
The usual failure is the long tail: a SaaS tool with its own login, a shared admin password, a cloud console user created years ago. Reconcile the list of active accounts in every in scope system against the HR roster at least quarterly. That reconciliation is also evidence that CC6.3 operates.
Mistakes to avoid
- Backfilling records after the audit starts. Auditors compare timestamps, and a signature dated today for a hire from March is obvious.
- Training completion tracked in a spreadsheet nobody can tie to the learning system.
- Counting only employees. Interns, contractors and part timers are all people with access.
- No owner. Name one person in HR and one in IT who share the roster every month.
What to do
- Export the current HR roster and every in scope system's user list, and reconcile them today.
- Write one onboarding checklist and one offboarding checklist, each with an owner and a deadline you can meet.
- Create a ticket template that forces the approver, the role and the date on each step.
- Set a monthly job: new hires, leavers and role changes, with the evidence folder linked.
- Run a quarterly access review that compares users to roles, and keep the signed result.
- Before the audit, pick five hires and five leavers at random and walk each trail yourself.
Quick check
Does a background check have to be done for every hire?
SOC 2 does not prescribe one. Your policy decides, and the auditor tests that you followed it. Write the policy you can sustain and apply it to every person in scope.
How fast does offboarding have to be?
The criteria set no number of hours. You choose a target in policy, such as the last working day, and the auditor tests against it.
How Safeguard helps automate this
Safeguard's compliance suite maps frameworks to controls and keeps evidence ready between audits. Evidence is collected from connected systems instead of by screenshot, so a leaver's account removal or a hire's access grant can be pulled from the source with a timestamp. Continuous monitoring and automated tests run between audits, which gives your HR and IT owners time back for other work. Technical evidence also comes from your real code and dependencies, not just policies. Safeguard helps you prepare and keep evidence ready. The independent auditor still performs the examination. See how controls map to evidence in the framework mapping demo, or book a call.
Sources
- AICPA, Trust Services Criteria (2017, with 2022 points of focus), criteria CC1.4, CC1.5, CC2.2, CC6.2 and CC6.3, paraphrased.
- AICPA description of Type 2 reports: tests of operating effectiveness over a period.
Last reviewed: 18 October 2026.
