What to do when a SOC 2 audit stalls
Most stalled SOC 2 audits are waiting on evidence, not on the auditor. List every open request with an owner and a date, clear the populations first, and agree a revised timetable in writing. If the delay is on the firm's side, escalate to the engagement partner named in the letter.
A SOC 2 audit that should have taken six weeks of fieldwork is in its third month. Nobody can say when the report will land, a customer is asking, and the team has stopped answering the request list because it feels like nothing happens when they do. This is common, and it is recoverable. The first job is working out which side the delay is on.
Why do SOC 2 audits stall?
| Cause | Whose side | How it shows up |
|---|---|---|
| Evidence nobody owns | Yours | Twenty open items, each waiting on a different person who thinks someone else has it |
| Populations never sent | Yours | The auditor cannot select samples, so nothing else can be tested |
| A control that did not run | Yours | Evidence for a quarter simply does not exist, and nobody wants to say so |
| Description does not match reality | Yours | Every answer prompts a follow-up because the evidence contradicts the text |
| Busy season or staffing change at the firm | The firm's | Your list is complete and nothing has moved for weeks |
| Review backlog | The firm's | Fieldwork finished, no draft, no date |
| Scope dispute nobody resolved | Both | The same requests bounce back and forth |
How do you get a stalled SOC 2 audit moving again?
- Find out whose side the delay is on. Put the auditor's request list next to what you have actually sent. If items are open on your side, the audit is waiting on evidence. If the list is complete and nothing moves, it is waiting on the firm.
- List every open request with an owner and a date. One sheet, one owner per row, and an internal due date a week before the auditor's. This is the single change that unblocks most stalled audits.
- Clear the populations first. Full lists of changes, hires, leavers and access reviews for the period. Until the auditor has them, they cannot pick samples and every other request is moot.
- Be honest about missing evidence. If a control did not operate for part of the period, say so now. It will be an exception either way, and the conversation is about management's response, not about finding the evidence.
- Agree a revised timetable in writing. Send a dated note: what is delivered, what is open on each side, the new report date. Ask the firm to confirm it.
- Escalate if the firm does not move. Two weeks without a revised timetable goes to the engagement partner named in the engagement letter. The partner signs the opinion and owns the delay.
- Tell the customer before they ask. The report is in fieldwork, here is the new date, here is the previous report or a bridge letter in the meantime.
What happens to evidence that never existed?
In a Type 2 you cannot create, after the fact, evidence that a control operated during the period. An access review that was not done in the second quarter cannot be done now and dated then; doing so would be falsifying audit evidence, and auditors look for it. The honest route is to tell the auditor, accept the exception, write a clear management response, and make sure the control runs for the rest of the period. One exception on access reviews in an otherwise clean report is ordinary. SOC 2 exceptions and qualified opinions explains when it becomes more than that.
When is it better to restart than to rescue?
Occasionally the gaps are so wide that finishing the current period would produce a qualified opinion. In that case it is sometimes better to agree with the firm to close this engagement as a Type 1, or to stop and start a fresh, shorter Type 2 period once the controls are running. Both options cost less than a qualified report that every customer asks about. It is a decision to make with the auditor, in writing, before the report is drafted, not after.
How do you stop it happening next year?
Collect evidence as the controls run, not when the request list arrives. Name a liaison and control owners before the period starts, agree scope in a countersigned memo, and get a weekly status note from the firm during fieldwork. Managing your SOC 2 auditor covers the whole routine, and getting through SOC 2 fieldwork on SOC2Prep is the week by week version.
Common questions
How long is too long for SOC 2 fieldwork?
For a small company with evidence ready, fieldwork usually takes two to six weeks and the report follows within a month or so. Anything past three months from the end of the period without a draft is a stalled audit and needs a written timetable.
Can we change auditors in the middle of a stalled audit?
You can, but the new firm will not rely on the old firm's fieldwork and will test the period again. It only makes sense when the incumbent cannot deliver at all. Changing SOC 2 auditors covers timing.
Will a stalled audit hurt the opinion?
A delay on its own does not. Missing evidence does. If the stall is because evidence does not exist, the outcome is exceptions, and possibly a qualified opinion if they cluster on one criterion.
What do we tell a customer who is waiting for the report?
That the examination is in fieldwork, the expected report date, and what you can share now: the previous report, a bridge letter, or a completed questionnaire. Customers accept delays they hear about early.
Get help recovering a stalled audit
Firms that run audit recovery work through the open list and the auditor liaison with you.
Get matched