PW-SOC2-002
90-day SOC 2 Type 1 checklist for SaaS founders
A practical 90-day plan from scoping Trust Services Criteria to auditor fieldwork for a first Type 1.
PW-SOC2-006 SOC 2 readiness spoke · Engage auditor · 5/7
SOC 2 auditor engagement letter before the report
TL;DR. The engagement letter locks scope, Trust Services Criteria, period, fees, and responsibilities before fieldwork. Some procurement teams accept a signed engagement letter plus roadmap as interim proof you are not vaporware—until the report lands.
Claim ladder Material statements on this page are labeled Verified, Inferred, or Unknown per editorial standards.
Key terms: engagement letter, Type 1.
Educational only — completing squares does not mean you are audit-ready. Progress is not stored (no localStorage).
ENGAGEMENT · EMPTY
No engagement letter yet. Use the squares when shortlisting firms — educational, not legal advice.
On this page
What the engagement letter is
It is the contract with your CPA firm for the SOC 2 examination: scope, period or as-of date, Trust Services Criteria, deliverables, fees, management responsibilities, and independence terms.
What to clarify before signing
- Exact system boundaries and locations.
- Categories in scope (and change-order process if buyers demand more).
- PBC turnaround expectations both ways.
- Draft review cycles and report delivery format.
- Whether readiness consulting is separate (independence matters).
Using it with procurement
Some security questionnaires accept a redacted engagement letter plus roadmap as interim assurance. Offer it when asked; do not wave it as a substitute for operating controls.
Print engagement squares
Mark negotiation items when printing. No progress is stored in this browser.
- Scope / TSC categories named
- Period / report type (Type 1 vs Type 2)
- Fee and change-order terms
- PBC / evidence responsibilities
- Timeline to fieldwork
Questions founders ask
Is an engagement letter the same as a report?
No. It proves you hired an examiner for defined scope.
Can the same firm implement and audit?
Independence rules matter—keep advisory and examination appropriately separated.
What fee surprises happen?
Scope changes, extra locations, and slow PBC cycles.
Sources
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- primary System and Organization Controls: SOC Suite of Services — AICPA & CIMA — SOC suite overview; links TSC download and related description criteria.
Linear path
← Path: SOC 2 evidence pack starter for Type 1
Next in path: What to send procurement in week 2 (SOC 2 in progress) →