Help center › Audit preparation › Sharing with your auditor
Audit preparation

Sharing with your auditor

Last updated November 2026 · 5 min read

When you're ready to engage an auditor, here's how to use ReadySOC to make that process as smooth as possible.

Give your auditor a secure, read-only link

The easiest way to share is with an auditor link. Your auditor opens it in a browser, with no account to create, and sees your readiness summary, every control with its status and owner, your approved policies and your evidence files.

1
Open the Report pageClick Report in the sidebar, then Share with auditor. Only admins can create links.
2
Name the link and set an expiryType the audit firm’s name so you can recognize it later, and choose how long it should work: 7, 14, 30, 60 or 90 days.
3
Decide about your notesTick Include my internal notes only if you want your auditor to see the notes on each control. It is off by default, because notes are often written for your team.
4
Copy the link and send itThe full link is shown once, right after you create it. Copy it and email it to your auditor.

Treat the link like a key. Anyone who has it can view the report, approved policies and evidence files until it expires or you revoke it. Send it only to your auditor, and revoke it as soon as they no longer need it.

Keeping track

The Auditor access page lists every link with its status (Active, Expired or Revoked), expiry date, number of views and when it was last opened. Click Revoke to stop a link working immediately. Your Activity log also records when an auditor views the page and which files they download.

Only approved policies are shown. Policies still in draft stay hidden from your auditor.

When are you ready to engage an auditor?

You're generally ready to contact an auditor when:

  • Your ReadySOC readiness score is at or near 100%
  • All applicable controls are marked Implemented
  • Every implemented control has at least one piece of evidence attached
  • Owners are assigned to all controls

Tip: Engage your auditor before you're fully ready — most firms will do a preliminary scoping call for free, and their feedback can help you fill gaps you might have missed.

What to send your auditor

Most auditors will send you a request list (called a PBC list — Provided by Client). You can use ReadySOC to respond to each item:

  • Policy documents — Your approved policies are already in the auditor link. You can also save them as PDFs and upload them to the matching controls.
  • Control matrix — The auditor link shows every control with its status, owner and evidence. You can also export the Report as a PDF.
  • Evidence files — Your auditor can download them from the link. For anything not yet uploaded, add it to the control and it appears on the link straight away.
  • System descriptions — Prepare a written description of your systems and how they interact. This is separate from ReadySOC but the AI guidance can help you draft it.

What to expect during the audit

1
Kickoff meeting The auditor walks through the scope, timeline, and what they'll need from you.
2
Evidence requests The auditor sends requests for specific documents, screenshots, and records. Respond promptly — delays extend the audit timeline.
3
Interviews The auditor may interview key personnel about your controls. Your ReadySOC notes and AI guidance audit questions help you prepare.
4
Draft report review The auditor shares a draft report. Review it carefully and address any exceptions noted before the final report is issued.
5
Final report You receive your official SOC 2 report. Share it with customers and prospects under NDA.

After the audit: Keep your ReadySOC workspace updated year-round. For Type II, your controls need to operate continuously — ReadySOC helps you maintain that evidence over time.