Audit scope
- Report type
- e.g. Type II
- Observation period
- e.g. 2026-01-01 to 2026-12-31
- Trust Services Criteria in scope
- e.g. Security, Availability, Confidentiality
SOC 2 Evidence Tracker
A SOC 2 Type II does not test whether you have a control. It tests whether the control operated throughout the period, and asks you to prove it with artefacts from specific dates. This tracker is organised around that reality: per control, per evidence artefact, per sample date.
What you get
- A control register mapped to Trust Services Criteria with one named owner each
- An evidence log recording what the artefact is, where it lives, and which period it covers
- An operating-frequency column, which is what determines how many samples the auditor pulls
- A gap and remediation view, so you know what will be a finding before the auditor tells you
How to use this template
- 1
Record the operating frequency before anything else. A control that runs quarterly yields four possible samples in a twelve-month window; a daily one yields hundreds, and the auditor will pick from them. Frequency determines how much evidence you must retain and whether a single missed month is fatal. Fill this column first.
- 2
Name a person, never a team. "Engineering owns it" means nobody will produce the artefact in audit week. The owner is the individual who can generate the evidence on request. If that person leaves, the control has no owner until you reassign it, which is itself worth knowing.
- 3
Capture evidence continuously, not in audit week. Type II covers a window, typically 3 to 12 months. Evidence of an access review you ran in month two cannot be recreated in month eleven. The system state has moved on. Save the artefact when the control runs, with the date in the filename.
- 4
Record gaps honestly and early. A control that did not operate for two months in the period is a finding whether or not you flag it. Flagging it early gives you time to remediate, add a compensating control, or discuss scope with the auditor. Discovering it during fieldwork removes all three options.
What's inside
Here's a preview. Unlock the free download to get all 6 sections (5 more below).
Related templates
More free templates IT teams use alongside this one.
Identity & Access
Get templateUser Access Review Template
An access review where every manager clicks approve is worse than no review, because it manufactures evidence that access was checked. This template is built to produce the two things auditors actually test: a named reviewer who attested, and proof that the revocations they asked for happened.
Security Operations
Get templateIT Risk Register Template
Risk registers fail in one of two ways: everything scores medium, or the register is written once for an audit and never opened again. This one forces a treatment decision and a review date on every row, because a risk with neither is a note, not a managed risk.
Security Operations
Get templateVulnerability Remediation Tracker
A scanner gives you findings. What auditors, boards, and your own future self need is the thing scanners do not produce: who owns each finding, when it is due, and what happened to the ones you decided not to fix. This tracker is built around the remediation clock rather than the scan.
Frequently asked questions
What evidence does a SOC 2 audit require?
+
Artefacts showing each control operated during the observation period: configuration exports, signed access reviews with their revocation logs, change records with approvals, scan reports with remediation tracking, restore test logs, and dated approved policies. Screenshots need to show the date.
What is the difference between SOC 2 Type I and Type II?
+
Type I assesses whether controls are suitably designed at a single point in time. Type II assesses whether they operated effectively across a period, usually 3 to 12 months, and tests that by sampling. Type II requires evidence captured as the controls ran.
How early should you start collecting SOC 2 evidence?
+
From the first day of the observation period. Evidence of a control that ran in month two generally cannot be reconstructed in month eleven, because the underlying system state has changed. Save each artefact when the control operates, with the date in the filename.
What happens if a control did not operate for part of the period?
+
It is likely to appear as an exception in the report. Document it yourself with the affected period, a remediation plan, an owner, and a date. Raising it early lets you remediate or discuss it with the auditor; finding it during fieldwork removes both options.