What happens during SOC 2 fieldwork: requests, sampling and what to prepare

Updated 25 October 2026

SOC 2 fieldwork is the part of the engagement in which the CPA firm tests your controls: it walks through them with the people who run them, asks for evidence, picks samples, and decides whether anything fell short. The report that follows is the firm's attestation, not something you produce. This guide explains the sequence of requests, how sampling works with one firm's worked example, where the published timelines disagree, and a checklist of who to have available and what to have ready for the week.

Where fieldwork sits between scoping and the report

Roughly, the engagement runs in this order: you agree scope and dates with the firm, a Type II report's observation period runs, evidence is gathered, fieldwork happens, a draft report is reviewed, and the signed report is issued. A-LIGN describes it the same way: evidence collection comes first, then once it is complete, fieldwork begins, with walkthroughs and testing before the report is generated (A-LIGN, via the Cloud Security Alliance). For how long the window itself runs, see the observation period guide; this page picks up where that one ends. Choosing the firm is a separate decision, covered in how to choose a SOC 2 auditor.

Kickoff and walkthroughs

A-LIGN describes fieldwork as formal walkthroughs of your environment, with the aim of understanding your controls, processes and procedures for both people and technology (A-LIGN, via the Cloud Security Alliance). Drata says auditors may schedule walkthrough meetings to understand controls through observation, and advises defining scope with your auditor in advance, covering your tech stack, data flows, infrastructure, business processes and people (Drata). Neither source describes a kickoff meeting, so ask your firm what its own kickoff covers and who it wants in it.

A walkthrough is a conversation, and the people in it have to describe what they actually do. The auditor compares your answer with your written policy, so rehearse before the real one (see the last section).

Evidence requests: the population first, then the samples

For a Type II report, Drata says auditors may request populations and then select random samples, and that they review evidence for each in-scope control and may ask for clarification or more evidence (Drata). A population is the complete list of times a control applied in the period: every hire, every leaver, every production change. The sample is picked by the auditor from that list, not by you. The practical consequence: every item on the list needs its record, not just the ones you would have chosen.

Policyseed's evidence checklist lists what each criterion usually leaves behind, from the same crosswalk the generator uses.

How sampling works: one firm's worked example

Linford & Co, a CPA firm, publishes a sampling article for SOC 1 and SOC 2 examinations that cites AICPA sampling guidance (originally published 18 December 2018, updated 23 April 2025) (Linford & Co). Its first example is security awareness training with a population of 389 employees. Treat it as how one firm explains its practice, not a rule: sample sizes are the firm's decision, so ask yours how it will test each control.

Linford's second example is a monthly reconciliation: the population is small, so the firm would select three months, and any deviation there means the control failed (Linford & Co). That matches the point made in the observation period guide: a control that runs rarely leaves few chances to recover from a miss.

What is commonly sampled

Drata lists five controls that may require populations and samples in a Type II audit: new hire onboarding, access removal for terminated employees, background checks, security awareness training, and code reviews for application changes (Drata). The list is one vendor's, and your firm may sample others. The middle column below is Policyseed's suggestion of the list to have exported for each, not anything Drata says.

The evidence items below come from the site's own crosswalk, so they stay in step with the criterion pages. They are examples a small SaaS company can produce, not a list your firm has approved. For background checks specifically, see whether SOC 2 requires them.

Onboarding and access removal

Evidence the crosswalk lists for user registration and deprovisioning.

Background checks and security training

Evidence the crosswalk lists for competent people.

Code reviews

Evidence the crosswalk lists for change management.

How findings are raised during fieldwork

The sources say little about the moment a problem is first communicated, so do not assume a particular rhythm. Drata says that after fieldwork the auditor determines whether any control exceptions exist, based on the evidence provided or missing, and that findings appear in the report's Additional Information section alongside your response (Drata). Linford's example shows the mechanism inside testing: a deviation widens the sample and, past a point, ends testing for that control (Linford & Co).

So ask your firm two things at the start: how it tells you about a deviation as it finds one, and what the window is for giving your response. For what an exception means for the opinion, and how to respond, read SOC 2 exceptions and qualified opinions. If you approved a departure from a policy on purpose, the policy exception register keeps the approval and its expiry on record.

Draft report, management letters and the subsequent-events inquiry

Drata says firms typically give you a draft to review before the signed report, and that after you approve it you sign a management assertion letter and a management representation letter. It also says the auditor checks for significant events after the audit period that could materially affect your internal controls, such as a major security incident or an organizational change (Drata). A-LIGN likewise says the client signs a management representation letter once the draft is approved internally and tells the team to proceed to the final report (A-LIGN, via the Cloud Security Alliance). Management signs these letters, so read each one yourself: you are attesting to statements in them, and the opinion is still the CPA firm's.

If a customer asks about the time after the audit period ends, a bridge letter is management's own statement on that gap. To understand what the finished report contains, see how to read a SOC 2 report.

How long each step takes: the sources side by side

The published figures differ, and they measure different spans, so they cannot be lined up neatly. Use them for orientation and get your own dates from your firm.

A-LIGN adds that fieldwork length varies with scope, locations, applications and trust criteria. Neither article is a rule, and an engagement with many systems or a late evidence request can run differently.

What to prepare in the weeks before

1. An evidence calendar. Every recurring control has an owner, a date and a place its record is saved. The observation period guide has the calendar of recurring items from the policy templates.
2. A named contact. One person receives the request list, assigns each line to an owner, and tracks what has gone back. Give them authority to chase colleagues.
3. The populations, exported. The five lists in the table above, plus any others your firm names, so a request for a list is a same-day answer instead of a research project.
4. A rehearsal. The free auditor interview prep sheet shows walkthrough questions per criterion, the sentences in your own policies that answer them, and the evidence to have open. The mock audit goes further: an AI model plays the auditor, asks questions drawn from your policies and checks each answer against their text. It is practice, not an audit, and it uses runs from an Audit Kit key ($59) or an Agency key. What auditors ask about policies lists the questions that come up most.

A checklist for the week: who to be available and what to have ready

Your firm's schedule decides the real days, so this is organized by role, not by day. The roles are suggestions for a small team; one person often holds several.

Related templates: the onboarding and offboarding checklist, the access review workbook, the system description and the policy acknowledgment guide. The timeline planner turns your own dates into a schedule, with every duration shown as an assumption you can change.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.