Trust BuildingAudit Insights & Preparation
Auditor Kickoff Meeting Checklist for SOC 2
Published · Updated ·12 min read
A SOC 2 auditor kickoff should confirm the system boundary, report type, criteria, observation period, evidence requests, and named contacts. Resolve conflicting assumptions before fieldwork begins. Prepare a written scope, current control documentation, and open questions so the meeting produces decisions and owners rather than another list of unresolved dependencies.
Key Takeaways
- •For the next operating decision, compare evidence auditors ask for with catching up on audit evidence.
- •AICPA & CIMA’s SOC overview describes CPA assurance services.
- •Leave the kickoff with named contacts, clear requests, and recorded scope decisions.
This checklist guide covers everything you need to prepare for, discuss during, and document after the SOC 2 auditor kickoff meeting, including agenda preparation, scope confirmation, evidence request review, timeline alignment, and common mistakes to avoid.
For the next operating decision, compare evidence auditors ask for with catching up on audit evidence. Confirm the work included, the evidence you need, and who will own implementation before committing to a provider.
What should you prepare before the auditor kickoff?
What to Prepare Before the Kickoff
| Preparation Item | Details | Why It Matters |
|---|---|---|
| System description draft | Document describing the system, services, infrastructure, and scope | Auditor reviews during kickoff to confirm scope; saves significant time if drafted in advance |
| Trust Service Criteria selection | Confirmed list of criteria in scope (Security, Availability, Confidentiality, etc.) | Must be finalized before fieldwork planning begins |
| System boundary documentation | Diagram or list of all in-scope systems, infrastructure, integrations, and environments | Prevents scope ambiguity that leads to unexpected testing requirements |
| Subservice organization list | List of all third-party providers (cloud, payment, identity, etc.) with carve-out/inclusive designation | Auditor needs to understand what is tested directly vs excluded through carve-out |
| Observation period dates | Confirmed start and end dates for the Type II observation period | Drives the entire fieldwork and reporting timeline |
| GRC platform access | Auditor access to evidence room ready to be provisioned | Allows auditor to begin reviewing evidence immediately after kickoff |
| Key personnel list | Names, roles, and contact information for everyone the auditor may need to interact with | Ensures the auditor knows who to contact for evidence, walkthroughs, and questions |
| Previous audit materials (if renewal) | Prior SOC 2 report, management letter, and remediation evidence | Allows auditor to focus on changes since the last audit |
Internal Pre-Meeting Alignment
| Alignment Item | Who to Involve | What to Confirm |
|---|---|---|
| Scope decisions are final | CTO, Compliance Lead | No pending debates about criteria, environments, or services in scope |
| Budget and timeline approved | CFO or executive sponsor | Engagement fee, fieldwork dates, and report delivery expectations are approved |
| Team availability during fieldwork | Engineering Lead, IT Manager, HR Lead | Key personnel are available during planned fieldwork dates |
| Evidence readiness status | Compliance Lead | Identify any known evidence gaps that need to be communicated to the auditor |
| Management representation letter authority | CEO or authorized signatory | Confirm who will sign the management representation letter |
What belongs on the kickoff agenda?
Recommended Agenda Structure
| Agenda Item | Duration | Lead | Purpose |
|---|---|---|---|
| Introductions | 5 minutes | Auditor + Compliance Lead | Introduce audit team and key organization personnel |
| Engagement overview | 10 minutes | Auditor | Review engagement letter terms, scope, and objectives |
| Scope confirmation | 15 minutes | Compliance Lead + Auditor | Confirm Trust Service Criteria, system boundary, observation period, and subservice organizations |
| System description review | 10 minutes | Compliance Lead | Walk through draft system description; auditor provides initial feedback |
| Evidence request list review | 15 minutes | Auditor | Review the evidence request list (PBC list); clarify evidence requirements |
| GRC platform and evidence room | 5 minutes | Compliance Lead | Demonstrate the evidence room; provision auditor access |
| Timeline and milestones | 10 minutes | Auditor + Compliance Lead | Confirm fieldwork dates, evidence submission deadlines, draft report timing, and final report delivery |
| Communication and logistics | 5 minutes | Both | Establish communication channels, meeting cadence, and point-of-contact protocol |
| Questions and action items | 10 minutes | Both | Address open questions; document action items with owners and deadlines |
| Total | 85 minutes |
How should you confirm audit scope?
Items to Confirm During Scope Discussion
| Scope Element | What to Confirm | Questions to Ask the Auditor |
|---|---|---|
| Trust Service Criteria | Final list of criteria in scope | "Are there any criteria you recommend adding or removing based on our services?" |
| System boundary | All in-scope systems, infrastructure, environments | "Does our system boundary include everything you expect to test?" |
| Observation period | Start date, end date, total duration | "Is our observation period length acceptable for a first-time [Type I/Type II] engagement?" |
| Subservice organizations | List of all subservice providers and carve-out/inclusive designation | "Are there any subservice organizations we should include that we have not identified?" |
| New systems or changes | Any infrastructure or process changes during the observation period | "How should we handle significant changes to in-scope systems during the observation period?" |
| Exclusions | Intentionally excluded systems, environments, or services | "Do you have concerns about any of our planned exclusions?" |
| Employee count | Confirmed employee headcount for sampling purposes | "What is the employee count threshold you will use for sample sizing?" |
Common Scope Misalignments to Address
| Misalignment | Risk | How to Address at Kickoff |
|---|---|---|
| Development environment assumed in scope | Adds testing requirements and potential findings | Explicitly confirm production-only scope with the auditor |
| Contractor vs employee classification | Affects sample size and personnel control testing | Clarify how contractors are categorized for SOC 2 purposes |
| Shared infrastructure with non-scoped services | May expand testing boundary | Define clear logical separation between in-scope and out-of-scope |
| Cloud provider responsibility model | Confusion about what the auditor tests vs what the cloud provider covers | Review the shared responsibility model and carve-out documentation |
Evidence Request List Review
What to Discuss About Evidence
| Discussion Point | Details | Action |
|---|---|---|
| Evidence request list (PBC list) delivery | When will the auditor provide the complete evidence request list? | Depends on scope and readiness |
| Evidence format expectations | Screenshots, exports, configuration files, or platform evidence room links? | Confirm whether the auditor accepts GRC platform evidence or requires specific formats |
| Evidence submission timeline | When must all evidence be submitted before fieldwork begins? | Depends on scope and readiness |
| Sample sizes | How many samples will the auditor test for each control? | Understand sampling methodology; typical samples are 25-40 for Type II |
| Evidence from the observation period | Which evidence must span the full observation period? | Identify which controls require period-covering evidence vs point-in-time |
| Manual vs automated evidence | Which evidence must be manually collected vs available through GRC platform? | Identify manual evidence requirements early to avoid last-minute scrambles |
Common Evidence Categories
| Category | Typical Evidence Requests | Responsible Team |
|---|---|---|
| Access management | User access lists, access review documentation, deprovisioning evidence | IT / Security |
| Change management | Change tickets, PR approvals, deployment records | Engineering |
| Monitoring and logging | Alert configurations, incident logs, monitoring dashboard configurations | DevOps / Security |
| Policies and procedures | All security policies with version history and acknowledgment records | Compliance |
| Risk assessment | Risk assessment documentation, risk register, treatment plans | Compliance |
| Vendor management | Vendor inventory, risk assessments, SOC 2 reports from critical vendors | Compliance / IT |
| Training | Security awareness training completion records | HR / Compliance |
| HR processes | Background check records, onboarding/offboarding procedures | HR |
| Business continuity | DR plan, backup configuration, DR test results | DevOps / IT |
| Encryption | Encryption configuration for data at rest and in transit | Engineering / DevOps |
Timeline and Milestone Alignment
Key Milestones to Confirm
| Milestone | When | What to Confirm |
|---|---|---|
| Evidence request list delivery | Depends on scope and readiness | Committed delivery date from auditor |
| Evidence submission deadline | Depends on scope and readiness | All evidence uploaded to GRC platform or shared drive |
| Fieldwork start date | Confirmed date | Ensure key personnel availability during fieldwork |
| Fieldwork duration | Depends on scope and readiness | Confirm expected duration; plan for potential extension |
| Status meetings during fieldwork | Weekly (typical) | Confirm cadence, day, time, and attendees |
| Draft report delivery | Depends on scope and readiness | Committed delivery date from auditor |
| Management review period | 3-5 business days after draft | Confirm time allowed for management review and feedback |
| Final report delivery | 3-5 business days after management review | Committed delivery date |
| Management representation letter | Before final report issuance | Confirm signatory and timing |
Fieldwork Planning
| Item | Discussion Point | Action |
|---|---|---|
| On-site vs remote fieldwork | Will the audit be conducted remotely, on-site, or hybrid? | Most SOC 2 audits are fully remote; confirm approach |
| Auditor team composition | Who from the audit firm will be conducting fieldwork? | Know who to expect for walkthroughs and questions |
| Walkthrough schedule | When will control walkthroughs be conducted? | Schedule walkthroughs for the first week of fieldwork |
| Question resolution process | How will auditor questions be communicated and tracked? | Establish a shared tracker or communication channel |
| Escalation process | What happens if the organization cannot provide requested evidence? | Agree on escalation timeline and process |
Communication and Logistics Setup
Communication Channel Establishment
| Item | Recommended Approach | Why |
|---|---|---|
| Primary communication channel | Shared Slack channel or email thread | Centralizes all engagement communication; creates an audit trail |
| Evidence sharing platform | GRC platform evidence room (preferred) or secure shared drive | Auditor accesses evidence directly; reduces back-and-forth |
| Meeting cadence during fieldwork | Weekly 30-minute status meetings | Maintains alignment; surfaces issues before they become blockers |
| Question submission process | Auditor submits questions through GRC platform or shared tracker | Trackable; ensures nothing is missed |
| Urgent issue escalation | Direct message or phone call to compliance lead | For time-sensitive issues that cannot wait for the next status meeting |
| Point of contact (organization) | Compliance lead as primary; engineering lead as secondary | Single point of contact reduces confusion |
| Point of contact (auditor) | Engagement manager or senior associate | Clear escalation to audit partner if needed |
Access Provisioning Checklist
| Access | When to Provision | Details |
|---|---|---|
| GRC platform auditor access | Depends on scope and readiness | Read-only access to evidence room; auditor can review evidence independently |
| Shared document drive (if used) | At kickoff | Shared Google Drive, SharePoint, or other document repository |
| Communication channel | At kickoff | Add auditor team to dedicated Slack channel or email group |
| Meeting calendar invitations | At kickoff | Send all recurring meeting invitations for the engagement period |
| Video conferencing access | At kickoff | Ensure auditor has video conferencing links for all scheduled meetings |
Key Personnel Introductions
Who Should Attend the Kickoff
| Role | Why They Attend | What They Contribute |
|---|---|---|
| Compliance Lead / Project Manager | Runs the engagement from the organization side | Primary point of contact; coordinates all evidence and walkthroughs |
| CTO or VP of Engineering | Executive sponsor; technical authority | Confirms scope; answers high-level architecture questions; signs off on decisions |
| Engineering Lead / DevOps Lead | Primary technical contact during fieldwork | Answers technical questions; provides infrastructure evidence; participates in walkthroughs |
| HR Lead | Personnel control owner | Provides background check, training, and onboarding/offboarding evidence |
| IT Manager (if separate from engineering) | Access management and endpoint control owner | Provides access review, endpoint management, and identity provider evidence |
| Auditor: Engagement Partner | Overall audit responsibility | Sets engagement expectations; escalation point |
| Auditor: Engagement Manager | Day-to-day audit management | Primary auditor contact during fieldwork |
| Auditor: Senior Associate / Staff | Fieldwork execution | Conducts testing; submits evidence requests |
Post-Meeting Documentation
What to Document After the Kickoff
| Documentation Item | Owner | Deadline |
|---|---|---|
| Meeting notes with all decisions documented | Compliance Lead | Depends on scope and readiness |
| Action items with owners and deadlines | Compliance Lead | Depends on scope and readiness |
| Confirmed scope and observation period | Compliance Lead | Depends on scope and readiness |
| Updated timeline with all milestones | Compliance Lead | Depends on scope and readiness |
| Evidence request list (when received from auditor) | Auditor > Compliance Lead | Depends on scope and readiness |
| GRC platform auditor access confirmation | Compliance Lead | Depends on scope and readiness |
| Communication channel setup confirmation | Compliance Lead | At kickoff |
Action Item Template
| Action Item | Owner | Deadline | Status |
|---|---|---|---|
| Provide complete evidence request list | Auditor | [Date] | Pending |
| Finalize system description draft | Compliance Lead | [Date] | Pending |
| Provision GRC platform auditor access | Compliance Lead | [Date] | Pending |
| Schedule control walkthroughs | Compliance Lead + Auditor | [Date] | Pending |
| Compile vendor SOC 2 reports for subservice organizations | Compliance Lead | [Date] | Pending |
| Confirm management representation letter signatory | Compliance Lead | [Date] | Pending |
Common Kickoff Mistakes
Mistakes That Lead to Audit Delays
| Mistake | Consequence | Prevention |
|---|---|---|
| Not finalizing scope before kickoff | Scope creep during fieldwork; additional testing and costs | Finalize all scope decisions before the meeting; bring documentation |
| No system description draft | Auditor cannot confirm scope alignment; delays evidence planning | Draft the system description before kickoff even if it is not perfect |
| Not asking about sample sizes | Surprises during evidence collection when sample sizes are larger than expected | Ask about sampling methodology and sizes at kickoff |
| No defined communication channel | Questions go unanswered; evidence requests get lost in email | Establish a dedicated channel (Slack, Teams) at kickoff |
| Not discussing evidence format expectations | Organization provides evidence in wrong format; requires re-collection | Confirm whether GRC platform evidence is acceptable or specific exports are needed |
| Skipping the evidence request list review | Organization discovers unfamiliar evidence requests during fieldwork | Walk through the PBC list at kickoff; ask clarifying questions |
| Not confirming fieldwork dates | Team members unavailable; walkthroughs postponed; fieldwork extends | Confirm exact dates and ensure key personnel availability |
| Executive sponsor absent from kickoff | Scope decisions require approval that delays the engagement | Require CTO or VP attendance at kickoff for decision authority |
AICPA & CIMA’s SOC overview describes CPA assurance services. It defines the assurance context; it does not establish vendor rankings, market prices, or a particular company’s readiness.
Frequently Asked Questions
What should you accomplish in a SOC 2 auditor kickoff meeting?
Confirm scope and criteria, agree on the observation period and key milestones, walk through the evidence request list, and settle communication logistics — who responds, in what channel, and how quickly. Ambiguity left open in this session tends to resurface as rework during fieldwork.
What should you prepare before the auditor kickoff call?
Your system description, the in-scope systems and Trust Service Criteria you intend to claim, a named owner for each control area, and GRC platform access for the auditor. Arriving with these settled turns the meeting into confirmation rather than discovery.
Who from your team should attend the auditor kickoff?
The compliance owner, an engineering or infrastructure lead who can speak to system boundaries, and whoever controls HR and access data. Executive attendance is optional, but every control area on the agenda should have someone present who can answer for it.
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
