Help center › Audit preparation › Sharing with your auditor
Audit preparation

Sharing with your auditor

Last updated July 2026 · 5 min read

When you're ready to engage an auditor, here's how to use ReadySOC to make that process as smooth as possible.

When are you ready to engage an auditor?

You're generally ready to contact an auditor when:

  • Your ReadySOC readiness score is at or near 100%
  • All applicable controls are marked Implemented
  • Every implemented control has at least one piece of evidence attached
  • Owners are assigned to all controls

Tip: Engage your auditor before you're fully ready — most firms will do a preliminary scoping call for free, and their feedback can help you fill gaps you might have missed.

What to send your auditor

Most auditors will send you a request list (called a PBC list — Provided by Client). You can use ReadySOC to respond to each item:

  • Policy documents — Download from your Evidence page and send directly.
  • Control matrix — Export the Report as a PDF to give the auditor an overview of your control environment.
  • Evidence files — Download individual files from the Evidence page as requested.
  • System descriptions — Prepare a written description of your systems and how they interact. This is separate from ReadySOC but the AI guidance can help you draft it.

What to expect during the audit

1
Kickoff meeting The auditor walks through the scope, timeline, and what they'll need from you.
2
Evidence requests The auditor sends requests for specific documents, screenshots, and records. Respond promptly — delays extend the audit timeline.
3
Interviews The auditor may interview key personnel about your controls. Your ReadySOC notes and AI guidance audit questions help you prepare.
4
Draft report review The auditor shares a draft report. Review it carefully and address any exceptions noted before the final report is issued.
5
Final report You receive your official SOC 2 report. Share it with customers and prospects under NDA.

After the audit: Keep your ReadySOC workspace updated year-round. For Type II, your controls need to operate continuously — ReadySOC helps you maintain that evidence over time.