Soc2 Audit Prep

# /cs:soc2-audit-prep — SOC 2 Type II Forcing Questions

**Command:** `/cs:soc2-audit-prep <scope>`

The SOC 2 Type II auditor pressure-tests any SOC 2 work. Six observation-period-disciplined questions before any Type II cycle.

## When to Run

- Pre-observation period (months 1-2 of cycle)
- Mid-observation period (month 6 checkpoint)
- Pre-field-test (month 10)
- Post-report (planning next cycle)
- After scope change (adding TSC category)
- After major incident during observation period

## The Six SOC 2 Type II Questions

### 1. What's the scope, and which TSC categories are in?
**Security always required; others elective based on customer ask.**
- Common Criteria (CC1-CC9) under Security always
- Availability (A1): for SaaS with SLA commitments
- Processing Integrity (PI1): for systems processing transactional / financial data
- Confidentiality (C1): for systems handling proprietary / confidential data
- Privacy (P1-P8): for systems handling personal data (overlap with GDPR if applicable)
- AICPA AT-C 205 description of system: complete + accurate + boundaries clear

### 2. Did any control skip a cycle during observation period?
**Type II requires consistent operation — single skipped cycle = likely exception.**
- Quarterly controls (e.g., access reviews): all 4 quarters covered
- Monthly controls (e.g., vulnerability scans): all months covered
- Continuous controls (e.g., logging): no gaps during period
- Annual controls (e.g., BCP exercises, training): completed within period

### 3. Show me the change-management evidence for any control implemented mid-period.
**Mid-period changes = high audit risk.**
- New controls implemented during observation: documented with change-management
- Modified controls: rationale + effective date + impact on prior samples
- Removed controls: rationale + customer impact assessment
- Strategy: avoid mid-period changes; defer to next cycle

### 4. Where's the exception log, and what's the materiality assessment?
**Real-time exception logging — not retroactive.**
- Each exception logged when discovered, not at audit time
- Per exception: what / when / impact / remediation / owner
- Materiality assessment: does the exception affect overall control operation?
- Audit firm threshold: typically 1-2 exceptions per control acceptable; 3+ = finding

### 5. Show me sample evidence from each TSC criterion in the FIRST month of observation.
**Not the last week — the first month.**
- Audit firm samples across the observation period
- Front-loaded evidence demonstrates operational discipline
- Back-loaded evidence (last 30 days) = "scrambling" signal
- Sample IDs should be reproducible from operational systems

### 6. What's the cross-walk to ISO 27001, and which evidence reuses?
**75% control overlap — the canonical pair.**
- Run `cross_framework_mapper.py` for HIGH-confidence overlap themes
- Each shared artefact cited by both audits (one collection, two reports)
- Coordinate audit calendar with cs-ciso-iso27001
- Avoid producing duplicate evidence files for same control

## Workflow

```bash
# 1. Scoping + gap analysis (pre-observation)
python ra-qm-team/skills/soc2-compliance/scripts/gap_analyzer.py current_state.json

# 2. Control matrix with ISO 27001 cross-walk
python ra-qm-team/skills/soc2-compliance/scripts/control_matrix_builder.py program.json

# 3. Continuous evidence tracking (during observation)
python ra-qm-team/skills/soc2-compliance/scripts/evidence_tracker.py evidence_log.json

# 4. Mock audit (pre-field-test month 10)
python ../../skills/compliance-os/scripts/audit_simulator.py soc2_scope.json
```

## Output Format

```markdown
# SOC 2 Type II Audit Prep: <scope>
**Date:** YYYY-MM-DD
**Observation Period:** YYYY-MM-DD to YYYY-MM-DD

## The Decision Being Made
[scoping | pre-observation | observation-status | pre-field | report-response]

## TSC Scope
- Security: included
- Availability: <yes/no>
- Processing Integrity: <yes/no>
- Confidentiality: <yes/no>
- Privacy: <yes/no>

## Observation Period Status
- Months elapsed: N / 12
- Controls operated consistently: % of total
- Cycle skips identified: <list>
- Mid-period control changes: N (each documented with change-mgmt: yes/no)

## Exception Log
- Total exceptions logged: N
- Per-control max exceptions: M (audit firm tolerance: typically 1-2)
- Material exceptions (overall control affected): <list>
- Remediation status per exception: complete/in-progress

## Sample Evidence Coverage
- Month 1-3 evidence: complete/gaps
- Month 4-6 evidence: complete/gaps
- Month 7-9 evidence: complete/gaps
- Month 10-12 evidence: complete/gaps (only for pre-report status)

## ISO 27001 Cross-Walk Reuse
- HIGH-confidence overlap themes: N
- Shared artefacts in evidence pool: <count>
- Duplicate evidence collection avoided: % savings

## Audit Firm Readiness
- Scoping discussion: complete/pending
- Description of system per AT-C 205: complete/pending
- Walkthrough rehearsal: complete/pending
- Sample preparation: complete/pending

## Verdict
🟢 ON-TRACK | 🟡 NEEDS-ATTENTION | 🔴 MATERIAL-RISK

## Top 3 Actions
[3 concrete next steps with owner + observation-period timing]
```

## Routing

- `/cs:compliance-readiness` — for multi-framework view
- `/cs:iso27001-audit-prep` — for ISO 27001 cross-walk pair (75% overlap)
- `/cs:gdpr-audit-prep` — for Privacy TSC overlap
- `/cs:ciso-review` — for executive cybersecurity strategy

## Related

- Agent: [`cs-soc2-auditor`](../../agents/cs-soc2-auditor.md)
- Skill: [`soc2-compliance`](../../../ra-qm-team/skills/soc2-compliance/SKILL.md)
- Playbook: [soc2_audit_playbook.md](../../../ra-qm-team/skills/soc2-compliance/references/soc2_audit_playbook.md)
- Adjacent: `../iso27001-audit-prep/`, `../gdpr-audit-prep/`, `../compliance-readiness/`

---

**Version:** 1.0.0