Why SOC 2 preparation is painful, and what actually fixes it
The controls are usually in place. What tends to be missing is contemporaneous evidence that they operated across the observation window, and that cannot be reconstructed after the window closes.
The Gwenda Team · · 2 min read
A Type II report asks whether your controls operated effectively over a period, not whether they exist today. That single word, over, is the reason first reports come back with exceptions.
The reconstruction trap
The common pattern looks like this. An organisation decides in March to pursue SOC 2. The observation window is set for January to September. Evidence collection begins seriously in August.
By then, a few things have already gone wrong:
- Access reviews for Q1 were never recorded, because nobody was collecting them at the time.
- Terminations in April cannot be timed against access revocation, because the identity provider's logs have rolled off.
- Change approvals exist in people's memory instead of the pull request record, because the process was informal until June.
None of these are fixable in August. The window has closed on them.
What contemporaneous collection means in practice
Evidence has to carry two things to be useful: the system it came from and when it was captured. A screenshot taken last week showing today's configuration says nothing about March.
The controls that most reliably fail this test are the ones where the evidence is an event rather than a state:
- Joiner, mover and leaver access changes, timed against the HR record
- Change management: reviews and approvals recorded on each individual change, because a policy describing the process is not a record of it
- Access reviews actually completed, by whom, and what they attested to
- Incident triage and closure times against your stated process
- Vendor reviews conducted inside the period
The overlap dividend
If you are also pursuing ISO 27001, most of a SOC 2 Security control set maps onto Annex A, particularly the technological controls in A.8. Evidence collected once satisfies both. The same is true of the Essential Eight for the technical controls.
That mapping is worth doing deliberately at the start, because the alternative is running the same evidence collection two or three times against different spreadsheets.
Collect it while the window is open
Gwenda gathers evidence continuously with source and timestamp attached, so the audit is a review rather than a reconstruction.
Related
See where you actually stand.
Gwenda reads the applications you already run, discovers the controls you already have, and measures them against the gold standard for your industry.