SOC 2 sample sizes: how many items an auditor tests
Updated
No standard sets a number. Each CPA firm uses its own sampling method, and the size depends on how often the control runs, how risky it is and how many failures the auditor will tolerate. What you control is the population: a complete record of every time the control ran. This guide shows what three sources say they pull, what one missed item does to a small sample, and what to keep from the first day of the observation period. All three sources sell audit or compliance services, so ask your CPA firm for its own numbers.
Short answer: no body sets the sample size
TCSA, a compliance consultancy, states it plainly: "Neither the AICPA nor any other body mandates sample sizes for SOC engagements" (TCSA, reviewed Aug 2026). Nicole Hemmer of Linford & Co, a CPA firm, lists three factors: the size of the population, the risk of the control, and how many deviations would be acceptable in testing it (Linford, updated 23 Apr 2025).
What a population is
TCSA defines a population as "the complete set of items to which a control was applied during the observation period". A scheduled control (a quarterly access review) has its own occurrences as its population. An event-driven control (approving a production change, removing a leaver's access) has the events as its population (TCSA). So the wording of your control decides what the auditor counts: a policy that says "every change is reviewed" makes every change part of the population.
One firm's starting samples by frequency
TCSA is the only source read for this guide that publishes a number per frequency. The table below is its own methodology for a 12-month period, and it calls these figures market practice, not a requirement of the attestation standards (TCSA). Your auditor's table may differ.
| How often the control runs | Population in 12 months | Sample, no deviation expected | Sample, one deviation |
|---|---|---|---|
| Annual | 1 | 1 | 1 |
| Quarterly | 4 | 2 | 4 |
| Monthly | 12 | 2 | 4-5 |
| Weekly | 52 | 5-9 | 12-15 |
| Daily | about 250 | 25 | 40 |
| Event-driven, small population | e.g. 18 | often all 18 | all 18 |
Source: TCSA, reviewed August 2026. It also notes that the monthly row is the one most often disputed. Michelle Strickler of Strike Graph adds that an annual control is always tested and that it is rare for an auditor to test a whole population, except an annual control with a sample of one (Strike Graph, updated 15 Jul 2024).
What one missed item does
Linford's worked example is security awareness training with no deviations expected: the auditor starts with 25 people. If one of the 25 did not attend, the sample grows to 40; if another is found, to 60; and if another is found, "sampling would stop, and it would be determined that the control is not operating effectively" (Linford). TCSA's daily row follows the same 25, 40, 60 steps, and it calls the pattern market practice rather than a rule (TCSA).
Small populations leave no room. TCSA's example is a quarterly control tested with a sample of 2: one miss is a 50% failure rate, and testing all four is usually the only way forward. Linford says the same of a monthly reconciliation: because the population is smaller, any deviation would be a failure of the control's operating effectiveness (Linford). A deviation is not automatically an exception in the report; TCSA writes that it starts an evaluation (TCSA). What exceptions do to the opinion is in SOC 2 exceptions and qualified opinions.
What this means for a small team
In the generated policies, quarterly and annual cadences are the most common, and those are the rows where one missed occurrence matters most. Two examples. The quarterly access review (item 5.3 of the Access Control Policy):
Quarterly access review. Within the first two weeks of each quarter the Security Owner exports user and role lists from Okta, the identity services of AWS and Vercel, GitHub, Supabase, Stripe, Datadog and Slack and production databases, reconciles them against the personnel list from People Operations, and sends each system owner their list for attestation. Owners respond within ten business days, removals are completed within five business days of the response, and the signed-off review is retained as evidence.
And the quarterly restore test (item 5.3 of the Backup and Recovery Policy):
Quarterly restore test. Each quarter Engineering restores a backup of at least one Tier 1 database and one storage bucket, no more than one day old, into an isolated environment, verifies row counts, checksums or sample records against production, measures elapsed time against the RTO, deletes the copy and files the test record for the Security Owner's review.
Each runs four times a year, so each needs four dated records. A record that was never made cannot be recreated later, so keep a log per recurring control from the first day of the observation period:
- One log per recurring control with the date, who performed it and a link to the output. The access review template and the restore test log are built for this.
- For event-driven controls, a list that the auditor can count: every change, hire or leaver in the period, exported from the system that holds it, not rebuilt by hand.
- Policy approvals recorded with a date, for example in the policy approval minutes.
- Control wording that matches what you do. A policy that promises a weekly review creates 52 occurrences to evidence, so before approval, change any cadence in the generated policies that you will not keep.
What evidence each control needs is in the evidence checklist, and what the auditor asks for in the testing weeks is in what happens during SOC 2 fieldwork. The mock audit checks whether you could produce a sample today.
Frequently asked questions
- Do auditors test every item?
- Rarely. Strike Graph writes that it is rare for an auditor to test the whole population, except an annual control, where the sample is the one occurrence. TCSA's table shows the same at small populations: an event-driven control with 18 occurrences is often tested in full.
- Is a deviation always an exception in the report?
- No. TCSA writes that a deviation starts an evaluation and is not automatically an exception in the report. The auditor may expand the sample, as in Linford's example, and decides whether the control still operated effectively. How exceptions read in the final report is covered in the exceptions guide.
- Can I give the auditor a sample I picked?
- No source read for this guide describes that. Each describes the auditor selecting from the full population you provide, which is why the population list has to be complete. Ask your CPA firm how it wants the list delivered.
- Where do larger numbers I have seen come from?
- Other sites quote different ranges for frequent controls. None of them is a standard either: TCSA writes that no body mandates sample sizes. The number your auditor uses comes from its own methodology, so ask it before the period starts.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.