Common Documentation Gaps Identified During SOC Audit Readiness Reviews

Your largest customer wants a SOC 2 report before renewal, but your readiness review returns a list of gaps. These often take the form of documents such as policies that no longer match how your team works, controls with no record showing they ran, vendor contracts silent on security, and risk assessments nobody has updated. A readiness review can flag these before your auditor does.

At Oberle Law, PLLC, we review SOC readiness from the policies, contracts, and commitments an auditor reads alongside your technical controls. Located in Bohemia, New York, we work with companies in Suffolk County and nationwide to close documentation gaps before the examination window opens, so the evidence you present to your auditor tells one consistent story.

What Does a SOC Readiness Review Look For?

A readiness review for a SOC 2 examination compares your documentation and day-to-day practices against the criteria your auditor will apply, then identifies what is missing, outdated, or unsupported. These are based on the AICPA's Trust Services Criteria.

Security applies to every SOC 2 report, while availability, processing integrity, confidentiality, and privacy are added based on your services and customer commitments. A SOC 1 examination instead focuses on controls relevant to your customers' financial reporting.

The AICPA's overview of its SOC suite of services describes these reports as a way for customers to assess the risks of outsourcing to you. The purpose is to explain why documentation carries so much weight and help outsiders decide whether to trust your systems.

Policies That Don't Match Your Daily Practice

One of the most common gaps includes policy sets that read well but describe your company in a way that no longer exists. Templates adopted during an earlier sales push may reference tools you replaced, roles you eliminated, or approval steps nobody performs.

Auditors will test what your policies say against what your employees actually do, so an aspirational policy can create an exception where none would otherwise exist. Related gaps can include missing version history, no documented annual review, and no signed employee acknowledgments. The fix is usually to draft narrower policies your team can follow, each with a named owner and a review date.

Controls Without Evidence They Operated

A control that happens but leaves no trace is difficult to prove. A Type 1 report will evaluate whether your controls are suitably designed as of a specific date. A Type 2 report will also test whether they operated effectively over a review period, commonly several months to a year.

That distinction drives the most costly gaps, such as access reviews completed over email and never saved, offboarding with no record of when access ended, verbal change approvals, and training with no completion records. Evidence that was never created generally cannot be reconstructed for a period already under review, so readiness work should establish the evidence trail before that period begins.

Vendor Contracts That Don't Mention Security

Your control environment extends to vendors who touch your systems and customer data, and the Trust Services Criteria address how you assess and manage that risk. Common gaps include no inventory of critical vendors, no record of reviewing vendors' own SOC reports, and agreements without confidentiality, breach-notification, data-return, or audit-rights provisions.

When a cloud provider performs part of your control environment, your report may need to describe that reliance. Contract language is where those expectations become enforceable, which is why vendor agreements sit at the center of our SOC audit readiness work.

Risk Assessments and Incident Response Plans Left on the Shelf

Auditors look for evidence that risk assessment and incident response are ongoing processes rather than documents written once. A risk assessment from three years ago, or one that ignores a new product line or acquisition, suggests you are not identifying risks as your business changes.

Incident response plans raise similar concerns when they name departed employees, omit legal and customer-notification decision points, or have never been tested. Documented exercises, with notes on what changed afterward, often matter as much as the plan itself.

When Customer Promises Outrun Your Controls

Some of the most consequential gaps sit outside the audit itself. Customer contracts, security questionnaires, and website copy sometimes promise encryption standards, uptime levels, or notification timelines that your documented controls do not support.

Describing your company as "SOC 2 certified" is another frequent misstep, since a SOC 2 is an attestation report issued by an independent CPA firm, not a certification.

When commitments diverge from your controls, the problem can extend beyond an audit exception to contract disputes with the customers who relied on them. Aligning those promises with your system description protects both the report and the relationships it is meant to support.

Build an Audit-Ready Record With Oberle Law, PLLC

Outdated policies, missing evidence, thin vendor contracts, and overstated customer promises rarely appear in isolation. They usually trace back to documentation that grew without anyone tying it to how your business actually operates. Documentation gaps close faster when the person reviewing them has worked inside the companies facing these audits.

At Oberle Law, PLLC, our attorney, Constance Oberle Geoghan, treats readiness as a design problem. We can help you identify where your policies, contracts, and evidence fail to connect, then build documentation your team can sustain long after the auditor leaves.

Based in Bohemia, New York, our Suffolk County SOC audit readiness attorney serves clients throughout the state and nationwide. Schedule a free consultation to review your policies, vendor agreements, and customer commitments before your examination period begins.