SOC 2 evidence collection: the six-week scramble

Six weeks before the audit, the compliance lead opens a list of eighty evidence requests. Engineers screenshot settings, IT exports access lists and HR pulls training records. Most of it arrives in the last two weeks.

The auditor accepts the screenshots, then asks for the same settings as they stood in March. Nobody saved them.

Audit evidence is the last part of compliance automation. It shows whether every other control ran, all year.

What is SOC 2 evidence collection?

SOC 2 evidence collection gathers proof that each control operated across the audit period: settings, access lists, approvals, training records and logs. Collected continuously, each piece carries its date and source, and a gap reaches the control’s owner the week it appears.

Why evidence becomes a scramble

1. Evidence is gathered for the audit. It shows the weeks before the audit, not the period the audit covers.
2. Screenshots have no source. An image of a setting doesn’t show when it was taken or from which system.
3. Owners hear about gaps late. A missing review is found during audit prep, months after it should have run.
4. Each framework gets its own round. SOC 2 and ISO 27001 each send their own requests for the same evidence.
5. Settings checks miss the work. A compliance tool sees a setting, not whether access was removed after a review.

What it costs

Each year, weeks of engineering and IT time go to exports and screenshots. A gap found during prep can’t be fixed after the fact, so it becomes an exception. The controls look worse than they ran, because the evidence only covers a few weeks.

What to fix first

1. Collect each control’s evidence on its own schedule. Settings daily, reviews quarterly, and changes on every event.
2. Store the date and source with every item. Pull from the system’s API instead of taking a screenshot.
3. Tell the owner about a gap that week. A control that didn’t run reaches its owner straight away.
4. Collect once and map to every framework. One piece of evidence serves each control it covers.
5. Send it to the compliance tool. The evidence sits where the auditor already looks.

The guide to building audit evidence collection has the prompts for each step.

Where it fits

Evidence comes from every other part: policy acknowledgement, user access review, SOC 2 change management and data retention. Masked logs make good evidence too, covered in masking sensitive data in logs. When a platform runs your controls, auditors ask about the platform as well. Tray.ai’s SOC 1 and SOC 2 Type 2 reports are available through the trust page.

For every part of compliance automation, from policy to audit evidence, see continuous compliance.