SOC 2 Type II audit readiness checklist for Indian SaaS startups

In short

A SOC 2 Type 2 report tests controls across a period, and AICPA standards set no minimum window (SmartSuite, October 2026); agree it with your auditor.

US and EU buyers often ask an Indian SaaS company for a SOC 2 report before they sign. The report a procurement team usually wants is Type 2. This checklist is for the founder or engineering lead who has to get the company ready for one. It covers scope, auditor choice, the observation window, evidence, and what to do when fieldwork ends. It is a planning aid; your auditor's engagement letter is the document that governs.

1. What you are preparing for

SOC 2 is an attestation report issued by a licensed CPA firm, not a certification. The AICPA describes its SOC suite as assurance reports that CPAs provide so users can assess the risks of outsourcing a service.

The two report types differ in time. A Type 1 report describes the design of your controls as of a single date. A Type 2 report covers design and also tests whether the controls operated effectively over a period. Type 2 is what most procurement teams ask for because it shows controls running, not only existing.

The audit has four phases: readiness, the observation window, fieldwork, and report drafting and review. Plan backward from the date a customer needs the report in hand.

2. Readiness checklist

Scope

[ ] List the customer security questionnaires you have received in the last year, and note which areas they ask about.
[ ] Choose the trust services categories. The 2017 criteria cover five: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is in every SOC 2 report; add others only when buyers ask for them.
[ ] Draw the system boundary: which product, which cloud accounts, which people and vendors are inside it.
[ ] Write the system description and name a control owner for each control.
[ ] Close the gaps you find before the window opens, not during it.

Auditor

[ ] Confirm the firm that signs the report is a licensed CPA firm. Many tool vendors are not CPA firms and cannot issue the attestation themselves.
[ ] Ask about the firm's size, capacity and client references, its qualifications and peer review results, the scope, its sampling procedures, and how it maintains independence.
[ ] Treat an offer that is unrealistically fast, easy or cheap as a warning. One practitioner quoted by Journal of Accountancy says a rejected report is "not worth the paper it's on".
[ ] Ask to see a sample report, and check that it looks tailored to your system and not a template.

Observation window

[ ] Agree the window length and the evidence format with the auditor before it opens. The AICPA standards do not set a minimum window length.
[ ] Make the window long enough that every control has operated enough times to be sampled, and no longer than your first customer deadline allows.
[ ] Check controls that run once a year, such as a policy review or a penetration test. In a short window they may occur only once, which leaves the auditor little to sample.
[ ] Do a dry run of the evidence before the window starts, and treat it as the gate that opens the window.

Evidence during the window

[ ] Keep records of the kind auditors sample across the whole period: tickets, approvals, review records and logs.
[ ] Collect access reviews, change approvals, incident records and vendor reviews as they happen, with dates and the name of the reviewer.
[ ] Store each piece in one shared place, named by control, so owners can answer evidence requests fast.
[ ] Keep a log of exceptions (a missed review, an expired access) and what you did about each one. Auditors raise exceptions in fieldwork; a clean log helps you answer them.

Fieldwork and report

[ ] Assign one person to reply to the auditor's requests, and set a reply time for control owners.
[ ] Review the system description and your responses to exceptions before the auditor finalises the report.
[ ] If a customer needs cover for the gap after the period ends, ask your management to issue a bridge letter. It is management's own representation, not an opinion from the CPA firm.

3. Why a template report is a risk

If a SOC 2 report is rejected by a buyer it has little value. Journal of Accountancy reported in May 2026 that AICPA peer reviewers are being told to check whether identical risk assessments, control designs, sample sizes or testing procedures appear across a firm's engagements; such engagements are known in peer review as nonconforming. For you, the point is practical: ask your auditor how the testing is tailored to your product, and read the draft report for your own system's details.

4. Watch for the 2027 criteria

On 26 October 2026 the AICPA's Assurance Services Executive Committee issued exposure drafts of proposed revisions to the Trust Services Criteria and Description Criteria used in SOC 2 examinations. The page does not give the final text or an effective date. Ask your auditor which criteria version your window will be tested against.

Related checklists on this site: SOC 2 compliance for SaaS founders and ISO audit readiness checklist. This is general guidance; confirm the details with your CPA firm.

Questions people ask

How long should a SOC 2 Type 2 observation window be?

The AICPA standards do not set a minimum. You and the auditor agree it. SmartSuite advises making it long enough for every control to be sampled, and no longer than your first customer deadline allows.

Can I get SOC 2 in a few weeks?

Journal of Accountancy reports that some tool vendors promise compliance in mere weeks, or even hours, and notes that "compliance" is a term never used in SOC 2 examinations. A Type 2 report needs an observation period, so check what is being sold.

What is the difference between Type 1 and Type 2?

Type 1 covers the design of controls at one date. Type 2 also tests whether they operated effectively across a period.

Do I need a CPA firm in India?

The source I opened says only that the report is issued by a licensed CPA firm. It does not say where the firm must sit. Ask your buyer whether they accept your auditor, and check the firm's licence and peer review record.

Sources

Nine stories, every morning at 09:15 IST.

Get the brief free →