SOC 2 Auditor Field Work: What Happens During the Audit

Fieldwork Overview

Auditor fieldwork is the testing phase of a SOC 2 engagement. For Type I, it tests whether controls are suitably designed at the as-of date. For Type II, it tests whether controls operated effectively throughout the observation period.

Fieldwork phases: (1) kickoff and system description review, (2) PBC evidence requests, (3) control walkthroughs and interviews, (4) additional evidence requests and follow-up, (5) exception discussion and management response, (6) draft report review.

Duration: Type I fieldwork — 2–4 weeks. Type II fieldwork — 4–6 weeks. The longer Type II duration reflects the need to test controls across the full observation period.

PBC Request Process

PBC (Provided by Client) list: within the first week of fieldwork, your auditor sends a list of evidence items they need to test specific controls. A typical PBC list contains 40–80 items covering all criteria in scope.

Response discipline: assign a dedicated person to manage PBC responses. Their only job during fieldwork is receiving requests, routing them to owners, collecting responses, and uploading to the auditor portal.

Response timeline: respond to each item within 2 business days. Longer delays extend fieldwork, potentially pushing report delivery by weeks. For time-sensitive requests (the auditor is blocking on a specific item), same-day response is appropriate.

Control Walkthroughs

A control walkthrough is a 15–45 minute session where an auditor asks a control owner to explain how a specific control operates. Questions: "Walk me through your access review process." "Who approves access requests?" "How do you handle access for contractors?" "What happens when an employee is terminated?"

Walkthrough preparation: brief every control owner on their specific controls 1–2 weeks before fieldwork. The owner should be able to describe the control clearly, reference supporting evidence, and answer follow-up questions without hesitation.

Key rule for walkthroughs: answer questions accurately and specifically. Do not describe an ideal process that does not reflect reality. Auditors cross-reference walkthrough answers against evidence — inconsistencies create exceptions.

How Auditors Sample Evidence

For Type II, auditors test whether controls operated throughout the observation period. They do this by sampling: selecting a subset of the population of control occurrences and testing each sample for effectiveness.

Sample sizes: AICPA sampling guidance (AU-C 530) varies by population size. For quarterly access reviews (4 occurrences in a 12-month period): the auditor may test all 4. For daily automated security scans (365 occurrences): the auditor may sample 15–25 days at random intervals.

The auditor selects sample dates independently — they are not limited to the dates you pre-selected. This is why consistent evidence throughout the observation period is critical. Gaps in the middle of the period will be found.

How Exceptions Are Identified

An exception occurs when the auditor's testing reveals that a control did not operate as described. Common causes: a quarterly access review was skipped for one quarter, a production deployment bypassed the required PR review, a terminated employee's access was not revoked within the documented timeframe.

When the auditor identifies a potential exception: they will discuss it with you before including it in the report. This gives you the opportunity to provide additional context (e.g. the evidence exists but was not provided, or there was a documented exception with compensating control) or to agree that an exception occurred.

Management response: for confirmed exceptions, you write a management response explaining root cause, remediation action taken, and preventive measures implemented. This appears in the final report alongside the exception description.

Fieldwork Completion

Fieldwork is complete when the auditor has tested all controls and resolved all open evidence requests. The auditor then drafts the report — typically 2–4 weeks after fieldwork close.

Before the final report, you receive a draft for review (typically 5–7 business days to review). Check: the system description accurately describes your service and infrastructure, control descriptions match what you actually implemented, exception descriptions are accurate, and your management responses are included correctly.