Your SOC 2 audit shouldn’t be the first time you discover a security gap

You received your SOC 2 report. That is an important milestone. But how confident are you in your security controls today?

Not just during the period covered by the report. Today. Does every critical system have appropriate access restrictions? Have former employees lost access? Do your policies reflect how the company actually operates? Would your incident response process work if something happened tomorrow?

For many growing companies, the honest answer is: we think so. An internal review turns that assumption into something you can examine, challenge, and improve.

SOC 2 is a milestone, not a permanent clean bill of health

SOC 2 Type II provides independent assurance about the design and operating effectiveness of controls within a defined system, scope, and period. It is not a certification that every security risk has been eliminated, or a guarantee that controls will keep working after that period ends.

New engineers join. Infrastructure changes. Vendors are introduced. AI tools enter everyday workflows. Permissions expand. A process that worked for a team of ten can become difficult to maintain at fifty.

The next examination still matters. But you do not need to wait for it to ask whether those changes have created a gap. Internal reviews give management a way to assess controls between independent examinations.

Three questions a useful internal audit should answer

1. Are our controls actually working?

An access policy does not prove that access is restricted. A vulnerability management process does not prove that critical issues are resolved. An incident response plan does not prove that the team can execute it.

A useful review connects the policy to actual operation: the access list, the termination record, the remediation ticket, the tabletop exercise. It examines the difference between what you intended and what happened.

2. What risks are we missing?

The most valuable findings are not always missing documents. They may be conflicting records, excessive permissions, unclear ownership, or a process that has not kept up with the product.

For an AI company, that might mean a model provider receiving customer prompts outside the documented data flow, or an agent using credentials with broader permissions than its task requires. These are business risks, not just checklist gaps.

3. What should we improve first?

A missing policy acknowledgment and unrestricted production access should not automatically receive equal priority. Consider exposure, the sensitivity of affected data, the likelihood of misuse, and other controls that reduce the risk.

The result should be a short, defensible action list: what needs attention, why it matters, who owns it, and how you will confirm that the change worked.

A practical example: one employee, three systems

Imagine a SaaS company removes a departing engineer from its identity provider. The offboarding ticket is marked complete. But a direct production account and a repository token remain active.

A review limited to the ticket might miss the gap. A review comparing the departure date, system access lists, token inventory, and activity records could surface it.

• Evidence: the departure record, offboarding ticket, dated access exports, token records, and relevant access logs.
• Finding: access appears to remain after the employee’s departure; confirm whether it is active and what it permits.
• Action: revoke unnecessary access, investigate relevant activity, and update offboarding to cover direct accounts and tokens.
• Follow-up: retain evidence of removal and test a later offboarding event to see whether the updated process works.

This is an illustrative scenario, not a reported customer incident. The point is the difference between a completed checklist and evidence that the control operates across the systems that matter.

AI can support the analysis. Judgment still belongs to people.

Frequent reviews are difficult when every cycle means requesting files, reading screenshots, comparing records, and rebuilding workpapers. That repetitive work consumes engineering time as well as audit time.

Audit intelligence can support repeatable tasks such as:

• Organizing evidence and mapping it to relevant control requirements.
• Comparing dates, records, and documented procedures.
• Flagging missing, outdated, or contradictory evidence.
• Identifying possible control exceptions for a person to investigate.
• Drafting workpapers that preserve links to the underlying evidence.

But a flag is not a final conclusion. An apparent access exception may involve a disabled account, a service identity, or a genuine control failure. The reviewer must validate the facts and assess the significance.

AI analysis is only as useful as the evidence and scope behind it. Incomplete exports, inaccessible links, or missing systems can leave blind spots. A responsible review makes those limitations visible rather than treating an absence of findings as proof that everything is secure.

Experienced auditors bring business context, professional skepticism, and judgment. AI should give them more room to apply those skills — not turn their decisions into a black box.

Review controls when the business changes

“Continuous” does not have to mean rerunning every control every day. Start with a regular, risk-based cadence, then add focused reviews when something material changes.

• Before your first SOC 2 examination: assess readiness, assign owners, and address gaps before relying on the controls.
• After infrastructure changes: revisit access, configuration, monitoring, and change approval for the affected systems.
• After a hiring surge: check onboarding, role assignment, and access review coverage.
• When adding an AI feature or critical vendor: review data flows, provider terms, agent permissions, and escalation paths.
• After an incident: assess the affected controls and verify that corrective actions operate as intended.

Keep each review bounded. Record the scope, evidence dates, findings, owners, and follow-up results. You do not need a large compliance team to begin; you need a clear question and reliable records.

Internal reviews and independent SOC 2 examinations have different roles

Internal reviews help management understand and improve its controls. They do not issue a SOC 2 report, replace the independent CPA’s testing, or shorten the period needed to demonstrate operating effectiveness.

Management remains responsible for its system and controls. An independent CPA firm determines the examination procedures, evaluates evidence and exceptions, and takes responsibility for its report. It also evaluates independence when other services have been provided.

Finding a gap before the examination is useful — but fixing it does not erase its history. Record when it occurred, what changed, and evidence of subsequent operation. Discuss the implications with the independent auditor rather than assuming remediation guarantees a particular opinion.

What we’re building at Skadi

Skadi is audit intelligence. SOC 2 is our starting point, but the goal is broader: make assurance more repeatable, transparent, and useful to the business receiving it.

Repeatable internal assessments

We’re working with a small group of SaaS and AI companies to pilot unlimited AI-supported internal assessments. The aim is to help teams revisit evidence and controls as the business evolves, rather than treat readiness as a one-time exercise. Pilot access and scope are agreed with participating companies; this is not a promise of unlimited independent CPA examinations.

Evidence-backed findings

Our approach is to connect findings to the evidence and control requirements behind them, so founders, CTOs, and reviewers can understand what was flagged and what still needs validation. Audit intelligence should make conclusions easier to challenge, not harder.

Independent CPA-led examinations

SOC 2 Type II examinations are delivered on Skadi by a network of independent CPA audit firms. Skadi supports evidence analysis and the workflow; the independent firm applies professional judgment and issues the report.

Models run on AWS Bedrock, with no training on customer data and no model-provider retention. That is separate from Skadi’s basic 30-day data retention; longer retention requires a written agreement. The independent CPA firm determines its own workpaper retention. See our Privacy Policy and Terms for the details.

Find the gap while you can still do something about it

You did not start your company to maintain compliance documentation. You are building a product, hiring people, and serving customers with limited resources. Security assurance should support that work.

The best outcome of an internal audit is not a perfect checklist. It is discovering something important, understanding its impact, and improving the control before the weakness becomes an incident.

Instead of asking only, “Are we ready for the auditor?” ask: “What do we need to improve in our business right now?”