Why this matters
SOC 2 evidence is the record that a control operated during the audit period. Auditors do not accept a description of your process. They ask for the change ticket, the access review export, the signed policy, or the scan report. When you gather those records at the end, you are rebuilding history from memory, and that is where gaps appear.
The scramble starts when the auditor sends a request list. It asks for populations, samples, and dated artifacts. If you cannot show a complete population, the auditor cannot draw a sample. If a file has no date or system name, it cannot be tied to the period. Missing items become exceptions, and exceptions make the report less useful to your customers. Evidence collection is an operations habit, not a documentation project. The control should produce the proof as it runs.
Before you start
Build a control matrix before you create folders. One row per control: control ID, plain description, owner, frequency, evidence artifact, system of record, and retention. The owner is the person who runs the control, not the compliance lead. If a control has no clear artifact, rewrite the control or change the process. A row that says screenshot of OK is not a plan.
Pick a repository and a naming rule. A restricted shared drive can work. A compliance tool with an audit log is better if you already use one. Name files with control ID, period, system, and ISO date, such as CC6.1_access-review_2025-03_okta.csv. Confirm the audit period and sampling method with the auditor. Ask what they need for each population and whether they accept native exports. Set up read-only auditor access and test it.
How to do it
Assign a backup owner for every control. The compliance lead runs the calendar and checks completeness, but the control owner supplies the artifact. Put recurring events on both calendars. Automated controls can push evidence weekly. Manual controls need a reminder at the moment of execution, such as the first business day of each quarter for access reviews.
Keep an evidence index that mirrors the auditor request list. Each row holds request ID, control ID, artifact, period, owner, status, and date shared. Review the index in a short monthly meeting. This is how you find gaps before the auditor does. Do not let evidence live only in email threads or chat. Move the record to the repository and keep it read-only.
- Map controls to artifacts and owners. Write one row per control in the matrix. Name the exact export, ticket type, or report that proves the control ran. If you cannot name the artifact, the control is not ready to audit.
- Set the collection cadence. Put recurring calendar events on the control owner and backup calendars. Match the event to the control frequency. Add a reminder three days before the due date.
- Capture the full population first. Export the complete list for each control, not a sample. Save the raw file before filtering. Record the query, date range, and system in the file name or a short readme.
- Prefer native exports over screenshots. A CSV or PDF from the system of record carries timestamps and structure. When a screenshot is necessary, include the URL, the signed-in user, the date, and the full screen. Do not crop out the context.
- File evidence at the moment of the task. When you approve a change, close a ticket, or finish an access review, save the record to the repository. Do not wait for a monthly batch. A small habit beats a long cleanup.
- Run a monthly evidence sweep. Open the matrix and check every control for the prior month. Mark missing items in the index and give the owner a due date. Escalate repeated misses to the owner's manager.
- Rehearse the auditor request list. Pull one sample per control yourself and time the work. Fix naming, access, or missing metadata before the auditor asks. Keep the request tracker updated so you can see what is outstanding.
How to check it worked
Run a mock sample. Choose five controls and pull the evidence as if you were the auditor. Start with the population, select the sample, then open each artifact. Check that the date falls inside the period, the actor matches the owner, and the action matches the control. If you need tribal knowledge to explain a file, it is not ready.
Test access and turnaround. A second person should find any control by ID and download the artifact without asking. Auditor read-only access should work from a fresh browser session. Log every internal evidence request and how long it took. If fulfillment takes more than a day, fix the cause: unclear artifact names, an undocumented export, or a file stored in a personal drive.
Mistakes to avoid
Do not collect everything in the last two weeks. That produces undated screenshots, missing months, and populations rebuilt from memory. Auditors notice when every file has the same creation date. Do not use chat as the system of record. A ticket with an audit trail is stronger. If chat is the only record, export the thread with timestamps and file it at once.
Do not over-redact or under-redact. Blacking out whole pages makes evidence useless. Leaving credentials or customer data exposed creates a security incident. Remove secrets and personal data, but keep the date, actor, action, and system. Do not treat a compliance tool as the control. A tool can remind and store. It cannot approve a change or review access. Test the integration and keep a manual fallback.
Do not let one person hold all the evidence. Document the process so a backup can run it. If you want a structured starting point, one option is the SOC 2 readiness assessment from Cloudverg, a fixed price of $7,500 over three weeks, which includes a policy and evidence inventory and a remediation roadmap.
Frequently asked questions
What counts as good SOC 2 evidence?
Good evidence comes from the system of record and carries a date, an actor, an action, and enough context to stand alone. A native export, a ticket with an audit trail, or a signed acknowledgment is stronger than a cropped screenshot. The artifact should tie directly to one control and one period.
What is a population in a SOC 2 audit?
A population is the complete list of items a control applied to during the period, such as all terminations, changes, or access reviews. The auditor samples from that list. If the list is incomplete, the sample cannot support the control.
Can I collect SOC 2 evidence after the audit period ends?
You can export records that systems still retain, but do not recreate or backdate them. A late export can be valid if the system log shows the original event. If the record is gone, the control has an exception. Build collection into the control so this does not happen.