Is this SOC 2 evidence request reasonable?

Pick the request your auditor sent and say a little about your audit. You get a verdict, what to send, and, when the request reaches past your scope, a reply you can paste.

Last reviewed 2026-10-01Written by Jacob Masse, TrazTech Inc.

Most items on a SOC 2 request list are routine. A handful are not: a template line left in by mistake, a request about a system you excluded, or a demand for raw data the control never needed. This tool sorts one request at a time into one of four answers, based on the criteria in your report, your scope and what you have already sent.

The four answers, and what they mean

Typical: send it

The request tests a criterion in your report and sits inside your scope. Send it promptly, labelled with the request number and the dates it covers.

Typical: narrow what you send

The control is in scope, but the request asks for more than the control needs, usually raw data or personal information. Send the evidence that the control operated and offer the rest on a screen share.

Ask which criterion it tests

The request might be legitimate, but nothing in your answers ties it to a criterion or a control. Ask, politely and in writing, before you produce it.

Outside your agreed scope

The request concerns a category you did not elect, a system you excluded or dates outside the period. Point to the engagement letter or scope memo.

The reasoning behind these, with a longer table of common requests, is on when your SOC 2 auditor asks for more than the criteria require. The wider routine, from scope memo to final report, is on managing your SOC 2 auditor. TrazTech, which runs this site, also publishes a longer auditor evidence simulator that walks through a whole request list.

Common questions