Disclaimer: The information provided in this blog is for general informational purposes only and does not constitute legal, tax, or accounting advice. Nothing on this site should be relied upon as a substitute for professional advice from a licensed attorney, CPA, or financial advisor. Please consult a qualified professional before making any financial or legal decisions.
"SOC 2 accounting practices" usually means one of two things: the SOC 2 examinations that CPA firms perform on service organizations, or the controls a finance team puts in place to support one. Neither is an accounting standard. SOC 2 does not tell you how to record revenue, accrue expenses, or close the books.
The term gets muddled because SOC 2 sits where accounting, IT, and vendor risk meet. Customers ask for a report, the finance leader gets the request, and the vocabulary is unfamiliar. This article clarifies what the term covers, explains how the examination works, and identifies the finance and accounting controls that tend to matter most.
What People Mean by SOC 2 Accounting Practices
SOC 2 is an attestation framework developed by the American Institute of Certified Public Accountants (AICPA). It is performed by licensed CPA firms. Because CPAs do the work, the topic often lands under "accounting," but the subject matter is a company's controls, not its bookkeeping. GAAP governs how transactions are recorded in financial statements. SOC 2 has no say in that.
The phrase is typically used in two ways:
- CPA firms providing SOC 2 examinations. A business searching this way wants an auditor who can examine its controls and issue a report.
- Finance and accounting teams adopting controls or software that support SOC 2. Here the reader is a controller or CFO asking what finance must do, or evaluating tools that help gather evidence.
A service organization is a company that performs services for other businesses, such as hosting data, processing payments, or running payroll. A SOC 2 report describes the controls at that organization and gives an independent CPA's opinion on them, measured against the AICPA's Trust Services Criteria. Attestation means the CPA is providing assurance on an assertion made by management, in this case that the described controls meet the criteria.
How it differs from a financial statement audit and SOC 1
A financial statement audit gives an opinion on whether the statements are fairly presented under an accounting framework such as GAAP. A SOC 2 report gives no opinion on the statements at all.
SOC 1 is the closer relative. It addresses controls at a service organization that are relevant to its customers' internal control over financial reporting, which is why payroll processors and loan servicers often provide one. SOC 2 addresses the operational and security controls that matter to customers' risk reviews. If a customer's auditor needs comfort about financial reporting requirements, the request is probably for SOC 1. If a customer's security or procurement team is asking, it is probably SOC 2.
The Five Trust Services Criteria and How Accountants Test Them
The Trust Services Criteria are the benchmark a SOC 2 examination uses. There are five categories:
- Security, protection against unauthorized access. This is the only required category, and its criteria are often called the common criteria.
- Availability, whether systems are available for operation and use as committed.
- Processing integrity, whether system processing is complete, valid, accurate, timely, and authorized.
- Confidentiality, whether information designated as confidential is protected.
- Privacy, how personal information is collected, used, retained, and disposed of.
Organizations choose which optional categories to include based on the services they provide and what customers expect. The AICPA periodically updates the supporting points of focus, so confirm the current version of the criteria with your CPA firm before scoping.
A concrete scoping example
Suppose a company sells billing or payroll software. Customers rely on it to calculate and move money correctly, so security and processing integrity are natural choices. Errors in calculation or duplicate payments are exactly what processing integrity addresses.
Now suppose a company provides cloud data storage. Customers care that their files stay accessible and that other parties cannot read them. That provider would likely add availability and confidentiality to security. Adding privacy would make sense only if it handles personal information in ways that make those criteria relevant.
What the auditor actually tests
The CPA evaluates whether controls are suitably designed to meet the criteria. In a Type II examination, the CPA also evaluates whether those controls operated effectively over a period. This is done by collecting evidence, not by taking management's word.
Typical evidence includes:
- Tickets showing that access requests and system changes were approved before they were made.
- Completed user access reviews with sign-offs and dates.
- System logs, configuration screenshots, and monitoring alerts.
- Onboarding and offboarding records, and records of employee security training.
For samples, the auditor may pick specific dates or specific employees and ask for the matching proof. A control that exists only in someone's head will not produce evidence, and an untested control cannot support an opinion.
Type I vs. Type II Reports: Choosing the Right Starting Point
Both report types describe the same system and the same criteria. The difference is time. A Type I report assesses whether controls are suitably designed as of a single date. A Type II report assesses design and operating effectiveness across a period, commonly somewhere between three and twelve months, with the length agreed with the CPA firm.
The comparison, in practical terms:
- Timeline. Type I reflects one point in time, so fieldwork can be relatively short once controls exist. Type II requires the full observation period to elapse before the report can be issued.
- Evidence. Type I needs proof that controls are designed and implemented, such as policies and configurations. Type II needs repeated proof across the period, such as every quarterly access review and a sample of changes and terminations.
- Customer perception. Many customers see Type I as a useful first signal. Many security teams prefer Type II because it shows controls working over time rather than on one day.
Which one to start with
A common path is to obtain a Type I report first to help move deals forward, then begin a Type II observation period. That sequence is not universal. Some customers will accept only Type II, and some contracts or questionnaires specify it outright. Others are satisfied by a Type I plus a commitment to follow with Type II.
Cost and elapsed time vary widely with scope, company size, system complexity, and the CPA firm, so treat any figure you see quoted as a rough benchmark at best. The most reliable approach is to ask your largest prospects and customers what they require, then work backward from that and request written quotes from firms. If you are weighing whether to handle this work internally or bring in outside help, this comparison of outsourced accounting vs in-house options can help frame the decision.
Finance and Accounting Controls That Support a SOC 2 Examination
IT or security teams usually own most SOC 2 controls, but finance systems are in scope more often than people expect, and finance frequently supplies the evidence. A controller who knows what auditors ask for can shorten the process considerably.
Access management
Auditors look for role-based access, meaning people can reach only what their jobs require, across accounting software, the ERP, payroll platforms, and banking portals. They also look for periodic user access reviews: a documented, dated check that each user's permissions are still appropriate, signed off by someone accountable. Prompt removal of departed employees is one of the most commonly sampled controls. Expect a request for a list of terminations during the period and proof of when each person's access ended.
Segregation of duties and change management
Segregation of duties means the person who initiates a transaction is not the one who approves it or records it. In practice, the person who sets up a vendor should not also release that vendor's payment. Where a small team cannot fully separate roles, compensating controls such as independent review of reports can help, and they should be documented. Teams that already struggle with signs of accounting errors will often find these gaps surface quickly during readiness work.
Change management applies to systems and configurations: changes to approval workflows, integrations, or user permissions in finance tools should be requested, approved, and recorded. A ticket trail is usually enough, provided it exists for every change in the sample.
Vendor management and documentation
Finance typically knows which vendors the company pays, so it is well placed to maintain a vendor inventory. Auditors often expect evidence that critical vendors were assessed, including a review of their own SOC 2 reports, with attention to the report's period, scope, any exceptions, and the complementary user entity controls the vendor expects you to perform.
Finally, keep policies, approvals, and evidence organized and dated. A shared folder structure by control and period, with consistent naming, saves hours when the auditor sends a request list. A well-built business accounting system makes this kind of organization much easier to sustain.
Common Mistakes When Preparing for a SOC 2 Audit
Treating it as a one-time project
In a Type II examination, controls must operate throughout the period. Companies that scramble to assemble evidence at the end often discover that a quarterly review was skipped in month two, and no amount of effort recreates it. Collect evidence as controls run, and assign an owner and a calendar reminder to each recurring control.
Getting scope wrong
Scoping too broadly adds systems, criteria, and testing that the business never needed, which raises effort and the chance of exceptions. Scoping too narrowly can produce a report that leaves out the system customers actually care about, so it fails to answer their questions. Include only the criteria your services and customer commitments support, and describe system boundaries precisely. For smaller organizations, a practical compliance management for small business approach can keep scope manageable.
Writing policies that do not match practice
Auditors test what is done, not what is written. A policy that promises monthly access reviews, when the team actually performs them twice a year, creates an exception. Write policies you can follow, then follow them.
Misunderstanding the outcome
There is no official "SOC 2 certification." The result is an attestation report containing the auditor's opinion, management's description of the system, and the test results. It is also not a simple pass or fail. The opinion may be unqualified, meaning the controls met the criteria, or it may be qualified, adverse, or contain noted exceptions where a control did not operate as described. Customers read the exceptions, so one noted exception is not automatically disqualifying, but how management responds to it matters.
Choosing a CPA Firm and Getting Ready: A Practical Sequence
Readiness work generally follows a sequence:
- Define scope and criteria. Decide which services and systems are covered and which Trust Services categories apply, informed by customer requests.
- Run a gap assessment. Compare current practices against the criteria and list what is missing or undocumented.
- Remediate. Implement missing controls, fix access issues, and align policies with actual practice.
- Collect evidence. Run the controls and confirm they generate the records an auditor will request.
- Begin the examination. For Type II, this is when the observation period starts.
What to look for in a CPA firm
- Licensed to perform AICPA attestation engagements.
- Experience with service organizations similar to yours in size and type of service.
- Clear communication: a defined request list, realistic timelines, and a named contact who answers questions during fieldwork.
Ask for references and sample report structure, and request a written proposal that defines scope, report type, and what is and is not included. Understanding typical accountant fees for small business engagements can also help you judge whether a quote is reasonable.
Auditor independence
The firm that performs the examination must be independent of the controls it evaluates. A firm that designed or implemented your controls would be reviewing its own work, which can impair independence. For that reason, readiness help and the attestation itself may need to come from separate providers, or at least be carefully separated. Ask any firm you are considering to explain its independence policies and how they apply to the services you want, and confirm the answer in writing.
Scoping First: The Next Step Toward a SOC 2 Report
SOC 2 is a controls attestation, not an accounting standard. It will not change how your books are kept, but it will test how access, changes, vendors, and evidence are managed, and finance sits closer to those areas than most teams realize.
The most useful next move is to define scope and run a readiness assessment with a qualified CPA firm, starting from what your customers actually require. If you would like to talk through your situation, you are welcome to contact Numbers Southwest Inc.
Schedule a call and discover how we can help your business grow.