Introduction and Overview of SOC 2 Audits for Texas Businesses | Austin, Dallas, Houston

Wednesday, 05 August 2020

1207 Hits

NDB, Texas’ leading provider of SOC 2 audit and attest services, offers the following introduction and overview to the world of SOC 2 audits. If you’re located in Austin, Dallas, Houston – or anywhere in the Lone Star State – and are considering a SOC 2 audit – then here’s what you need to know NOW.

Understand What a SOC 2 Audit Actually is

So, what’s a SOC 2 audit? A process? A certificate? Something else? There’s quite a bit of confusion on this issue alone, so let’s clear the air. First and foremost, a SOC 2 audit is an assessment conducted by a Certified Public Accounting (CPA) firm against the AICPA Trust Service Principles criteria. It’s essentially an audit performed to examine a service organization’s policies, procedures, and processes – that is – one’s “internal controls.”

There are two (2) types of SOC 2 audits; SOC 2 Type 1 and SOC 2 Type 2, and yes, they are different in a few regards, so let’s talk about this. A SOC 2 Type 1 is an audit performed for a stated date in time, such as August 31, 20xx. However, a SOC 2 Type 2 assessment is an audit performed over an agreed upon test period time, such as January 1, 20xx to June 30, 20xx. The main difference is that a Type 2 tests controls over a test period, whereas a Type 1 just assesses controls for a specific date.

Begin with a SOC 2 Scoping & Readiness Assessment

Getting off on the right track with SOC 2 compliance for Austin, Dallas, and Houston businesses starts by performing a much-needed SOC 2 Scoping & Readiness assessment by a well-qualified CPA firm, such as NDB. The benefits of this exercise are the following: The ability to properly identify audit scope in terms of business processes examined, personnel involved, physical locations in scope, and what relevant third-parties are involved.

Additionally, two other notable benefits are (1). Identifying gaps and control deficiencies requiring remediation and (2). Putting in place a plan-of-action for correcting control weaknesses. Diving head first into a SOC 2 audit without any real upfront scoping & readiness work is not recommended, so talk to the experts today at NDB.

Call NDB today at 512-522-4943 (Austin), 214-272-0967 (Dallas), or at 713-331-5492 (Houston) to learn more about NDB’s SOC 2 services, or email us at This email address is being protected from spambots. You need JavaScript enabled to view it. to discuss your audit & compliance needs.

As for pricing, we include our SOC 2 Scoping & Readiness Assessments as part of NDB’s fixed-fee pricing.

Perform Essential Documentation Remediation

Becoming SOC 2 compliant for Austin, Dallas, and Houston businesses also means developing a wide-range of information security policies and procedures. Successful SOC 2 compliance is heavily dependent upon having robust documentation in place, so please keep this in mind. NDB can help, as we provide our SOC 2 Policy Packet to all of our valued clients. In it, you’ll find dozens of well-written, high-quality information security policy templates for helping develop all the necessary documentation for SOC 2 compliance.

How valuable is the SOC 2 Policy Packet? The feedback we’ve received from our clients is that it saves them dozens of hours and thousands of dollars on policy development. Additionally, the SOC 2 Policy Packet also includes a risk assessment program, security awareness training package, along with a third-party vendor management program. Auditors will be looking for your policies and procedures for SOC 2 compliance, and NDB will have you covered.

Perform Essential Technical/Operational Remediation

You’re now well aware of the importance of policies and procedures, but it’s equally important to spend time remediating any number of technical/operational controls. Some examples are the following: (1). Poor password configurations. (2). Insecure server hardening. (3). Not testing one’s incident response plan. The list can be quite lengthy, all the more reason for performing a SOC 2 Scoping & Readiness Assessment with NDB.

Know What Auditors are Looking for in Terms of Audit Evidence

Auditors will request a large amount of audit evidence – no question about it – so take note of the following types of materials they’ll be expecting from you throughout the SOC 2 journey:

Policies and Procedures: Remember all those information security policies and procedures we just spoke about? Well, expect to hand them over to auditors. In fact, policies and procedures generally constitute the biggest set of deliverables in terms of audit evidence.

Screenshots of system settings: From password complexity rules to evidence of anti-virus in place – and more – auditors will ask for any number of system settings screenshots, so be advised.

Output logs: From firewall configuration files to audit logs – and more – expect to hand over to the auditors a wide range of output logs.
Memos: Many times, auditors will request that a specific statement or control is documented in the form of a signed memo on company letterhead. To auditors, this is often some of the best audit evidence – and why – because someone has assigned their signature to it.

Undertake Continuous Monitoring Efforts

Once an organization has become SOC 2 compliant, it’s important to know that monitoring controls helps not only ensure continued compliance, but makes life quite a bit easier for everyone (you and the auditors) the next time around. And yes, SOC 2 is an annual compliance requirement, more on that below.

It’s an Annual Commitment – so be Prepared

Welcome to the world of regulatory compliance and the world of SOC 2 auditing. Most service organizations quickly realize that such auditing is an annual exercise, so be prepared and be ready for it. NDB offers fixed-fees for SOC 2 services for organizations all throughout Texas – Austin, Dallas, Houston, San Antonio, and beyond – so contact us today and let’s get started.