Software companies: what an audit looks like

Independent CPA firm (SOC 2 examination under AICPA standards)

The firm examines management's description of the system and the controls against the Trust Services Criteria for security, availability, processing integrity, confidentiality or privacy. A Type 2 report adds tests of operating effectiveness over a period.

How often. Management chooses the report period. In CBIZ's 2024 sample of 193 SOC reports, 75.6% covered 12 months and 17.6% covered 3 to 11.75 months.

Source ↗

ISO/IEC 27001 certification body (accredited)

Two-stage initial audit, then surveillance and recertification audits against the 2022 edition. Certification bodies had to move all clients off the 2013 edition by October 31, 2025.

How often. At least one audit in every calendar year, either surveillance or recertification, under ISO/IEC 17021-1 clause 9.1.3 as read by European Accreditation.

Source ↗

Customer security reviews

Buyers send security questionnaires such as the Cloud Security Alliance CAIQ, now at version 4.1 with 283 questions. CBIZ lists customers' security concerns as a reason a SOC 2 report is required.

How often. No standard interval. Each customer's vendor risk program sets it, and CBIZ cites a Cyentia Institute finding that 84% of companies use security questionnaires, some with over 2,500 questions.

Source ↗

Management's assertion and system description

A SOC 2 Type 2 report contains management's assertion, a description of the system that meets description criteria DC 200, the service auditor's report, and the tests of controls with results.

AICPA Illustrative SOC 2 Report with Illustrative System Description; 2018 SOC 2 Description Criteria (DC 200)Source ↗

Information security policy, scope and objectives

The certification body asks for the ISMS scope, an information security policy written to the standard and disseminated to everyone affected, and the information security objectives.

ISO/IEC 27001 clauses 4.3, 5.2 and 6.2, as set out in NQA's ISO 27001 checklistSource ↗

Risk assessment, risk treatment plan and Statement of Applicability

A defined risk assessment process that gives consistent results, the risk assessment report, a treatment plan approved by risk owners, and a Statement of Applicability that explains for each Annex A control whether it is implemented and why.

ISO/IEC 27001 clauses 6.1.2, 6.1.3 and 8.2, as set out in NQA's ISO 27001 checklistSource ↗

User access reviews and termination records

The two leading exception areas after business approvals. CBIZ advises control owners to keep the parameters or query used to produce the user listing they reviewed, so the examiner can test completeness and accuracy.

CBIZ 2024 SOC Benchmark Report, Control ExceptionsSource ↗

Change management records

Change tickets showing testing approval and approval for promotion. CBIZ points to a central repository with mandatory fields as the way to keep key control points from being missed.

CBIZ 2024 SOC Benchmark Report, Control ExceptionsSource ↗

Code of conduct, handbook and background check records

Records that personnel reviewed the code of conduct or handbook when hired, and that background checks were performed. These were among the causes of qualified SOC opinions in CBIZ's sample.

CBIZ 2024 SOC Benchmark Report, Audit OpinionSource ↗

Internal audit programme and management review results

The certification body expects an ongoing internal audit programme and regular management reviews, with a process for fixing and finding the root cause of nonconformities.

ISO/IEC 27001 clauses 9 and 10, as set out in NQA's ISO 27001 checklistSource ↗

Control occurrences across the report period

For a Type 2 report the examiner tests operating effectiveness by sampling from populations such as access reviews, leavers and changes. AICPA staff FAQs cover the use of sampling, and the AICPA's May 2026 reviewer alert treats identical sample sizes across clients as a warning sign.

Populations behind the evidence

CBIZ reports exceptions tied to information provided by the entity appearing for the first time in 2024. It advises control owners to keep the parameters or query used to generate any listing they review, to support completeness and accuracy.

Leadership and staff interviews

NQA's checklist notes that the senior leader responsible for the ISMS will be interviewed during the audit.

Control exceptions in SOC reports

54.9% of 193 reports had at least one exception 2024

54.9% of 193 SOC 1 and SOC 2 reports carried at least one exception. CBIZ lists the top causes as business approvals or reviews (16.5%), user access reviews (15.6%), terminations (12%) and change management (11.7%). Only 10.9% of reports were qualified.

Source ↗

Manual controls and system access

89% of exceptions from manual controls; 17% from system access Reports issued 2021 to 2023, published October 2024

In KPMG's analysis of over 400 controls assurance reports (SOC 1, SOC 2 and related), manually operated controls produced 89% of exceptions and system access accounted for 17%. Management review, system access and authorization controls were the consistent exception areas.

Source ↗

ISO 27001 risk assessment (clause 6.1.2)

27% of audited organizations DNV data from 2018 (ISO/IEC 27001:2013 edition)

DNV found that 27% of audited organizations did not meet the risk assessment requirement, usually because the approach did not give consistent results or did not capture all relevant risks.

Source ↗

ISO 27001 audits overall

78% with any finding; 40% with a severe finding DNV data from 2018 (ISO/IEC 27001:2013 edition)

Of more than 1,700 companies holding ISO/IEC 27001 certificates, 78% had at least one finding and 40% finished the audit with at least one severe finding. Almost 40% had findings under Annex A.12, IT system management.

Source ↗

Code of conduct and handbook review at hire

In CBIZ's sample, code of conduct or employee handbooks not reviewed by personnel on hire was one of the next most common causes of qualified opinions, at 7.1% of qualified reports. CBIZ places these controls with human resources and says entity-level controls matter in SOC 2.

Policy and procedure controls carry a large share of SOC 2

KPMG found that policies and procedures controls were 34% of controls in technology sector SOC 2 reports, because the criteria require them. It adds that such manual controls are more likely to have exceptions.

ISO 27001 policy approval and dissemination

NQA's checklist asks for an information security policy that meets the standard, disseminated to everyone affected, internally and externally, with top management responsible for the ISMS and documented changes to documents under control.

Risk owner approval in the Statement of Applicability process

The treatment plan needs approval from risk owners, and residual risk is accepted by them after the assessment is rerun. The Statement of Applicability records for each Annex A control whether it is implemented and why.