SOC 2 Readiness for Mid-Market Companies: What to Do Before You Call an Auditor

SOC 2 Readiness for Mid-Market Companies: What to Do Before You Call an Auditor

2026-10-28

Takeaway: SOC 2 is not a badge you buy. It’s a CPA firm’s opinion on your security controls, and the cheapest path is to decide your scope, write down what you already do, and run your controls for real before an auditor ever shows up.

If a big customer just asked for your “SOC 2 report,” you’re not alone, and you don’t need to panic. You do need a plan, because the fast-and-cheap offers flooding this market are exactly what the accounting profession is now warning about.

What SOC 2 actually is (in plain words)

SOC 2 is an examination performed by a licensed CPA firm under standards set by the AICPA, the US accounting profession’s standards body. The firm tests your controls against the 2017 Trust Services Criteria (with revised points of focus, 2022), which cover five categories: security, availability, processing integrity, confidentiality, and privacy.

A few terms worth knowing:

  • Controls are the things you do to manage risk: MFA on email, access reviews, backups you actually test.
  • Type 1 reports on whether your controls were suitably designed as of a point in time.
  • Type 2 reports on design and whether controls operated effectively throughout a period, and it includes the auditor’s tests and results (AICPA SOC 2 guide, Table 1-1, via PwC Viewpoint, Oct 15, 2022).

Type 2 shows your controls worked over time, not just on paper. Audit firm Baker Tilly’s SOC FAQ says Type 1 reports provide less comfort and are uncommon, that a SOC 2 Type 2 period is typically at least three months, and that recurring reports typically cover 12 months.

Step 1: Confirm what the customer actually needs

Before you spend a dollar, ask the customer three questions:

  1. Do you need a SOC 2 report, or will a completed security questionnaire plus evidence do for now?
  2. Is Type 1 acceptable as a first step, with Type 2 to follow?
  3. Which trust services categories matter to you?

Security is the one nearly every report includes. Adding availability, confidentiality, processing integrity, or privacy widens the scope and the work, so only add what customers actually rely on.

Step 2: Draw the boundary around the system

A SOC 2 report describes a specific system: the people, software, infrastructure, data, and procedures behind the service you sell. The AICPA description criteria govern how you describe it.

Keep the boundary tight. If customers only care about your client portal and the cloud environment behind it, don’t drag your warehouse Wi-Fi into scope. List the vendors that touch that system too (cloud host, payroll, help desk tool), since you’ll need to show how you oversee them.

Step 3: Write down what you already do, then find the gaps

Most mid-market companies already have half the controls. They just aren’t written down or done consistently. Build a simple table: criterion, your current control, owner, evidence, gap.

Common gaps to check first

  • Access: no quarterly review of who has admin rights, and departed employees who still have accounts.
  • Change management: production changes with no ticket or approval trail.
  • Vendor oversight: no record of reviewing key vendors’ own security reports.
  • Incident response: no written plan, or a plan nobody has rehearsed.
  • Risk assessment: no annual, documented look at what could go wrong.

Step 4: Run the controls before the clock starts

A Type 2 report tests whether controls operated over the period. That means you need evidence: the access review done in March, the backup restore test in June, the security training completions. Start generating that evidence now, and give each control a named owner and a calendar reminder.

Compliance software can help you organize evidence and track tasks. It can’t do the controls for you.

Step 5: Pick the auditor carefully

This is where the market has gotten messy. In an April 30, 2026 Journal of Accountancy podcast, Amy Pawlicki, the AICPA’s vice president of Assurance & Advisory Innovation, described vendors “promising quick turnarounds and exceedingly low flat-rate prices for what they call SOC certification,” and alleged boilerplate reports signed off by CPAs who hadn’t actually performed the engagement. In May 2026 the AICPA Peer Review Board told peer reviewers to look harder at firms whose SOC 2 reports have identical risk assessments, sample sizes, and testing, and at whether engagement timelines are reasonable (Journal of Accountancy, May 2026).

A report your customer’s security team doesn’t trust is money wasted. When you interview firms, ask:

  • Is the signing CPA firm licensed and enrolled in peer review?
  • Who on your team will test our controls, and how will they tailor the work to our risks?
  • What timeline do you propose, and why?

Step 6: Plan for year two now

SOC 2 isn’t one-and-done. Reports are typically renewed annually, and the criteria evolve. On Oct 26, 2026, the AICPA’s Assurance Services Executive Committee issued exposure drafts of proposed 2027 Trust Services Criteria and Description Criteria for public comment. They’re proposals, not final rules, so today’s reports still use the 2017 criteria. Just build your program so controls can absorb changes without a rebuild.

The bottom line

SOC 2 readiness is mostly operational discipline: a tight scope, written controls with owners, evidence collected as you go, and an auditor who actually audits. Do the boring parts well and the report becomes a sales asset instead of a scramble.

If a customer is asking for SOC 2 and you’re not sure where to start, a SOC 2 readiness plan is part of Yellow Coop’s fractional CISO work. See how we engage or get in touch.

Sources