A customer contract renewal comes with a new condition attached: produce a SOC 2 report within 90 days, or lose 20 percent of your revenue. The organization has never gone through a formal audit before. Someone gets handed the job of "getting SOC 2 ready," usually the most capable IT or ops person in the building, someone who is excellent at running the business and has never sat through an audit in their life.
Antares has watched this exact scenario play out, and it follows a predictable arc.
Stage one: the spreadsheet says you're fine
The person assigned to readiness downloads a generic SOC 2 checklist and starts mapping it against what they believe the company does. Background checks on staff? Green, HR runs them. Access control? Green, MFA is enforced for office staff. Change management? Green, there's a ticketing system. Vendor management? Green, there are signed contracts with the major vendors.
Three weeks later the spreadsheet is 90 percent green, and the message to leadership is "we're basically there, we just need an auditor to confirm what we already do."
The flaw isn't laziness. It's the question being asked. The spreadsheet asks, "do we have something that looks like this control?" The audit asks, "can you produce dated, system-generated evidence that this control operated consistently over a period of months?" Those are different questions, and the gap between them is where readiness projects fail.
Stage two: the independent assessment finds what the spreadsheet missed
An independent readiness assessment doesn't take the spreadsheet's word for it. It interviews staff across departments, inspects actual system configurations, and samples real records instead of policy documents.
In one engagement Antares worked, the pattern was almost a clean sweep of the green rows turning red on inspection:
- Background checks were confirmed for full-time staff, but a temp staffing agency supplied a large share of peak-season labor, and its contract said nothing about screening. Those workers had system access.
- MFA was enforced for office staff, but floor terminals ran on a single shared login, so there was no way to prove who touched a given record. Two former contractors also still had active admin accounts because there was no offboarding checklist.
- A ticketing system existed, but it only covered internal helpdesk requests. Actual configuration changes to core business systems were made ad hoc, with no approval trail, no testing evidence, and no rollback plan.
- Vendor contracts existed, but there was no process for reviewing vendor security posture, no current list of who had access to what data, and no annual review of vendor SOC 2 reports.
None of this showed up in the self-assessment, because the self-assessment was checking for the existence of a thing, not evidence that the thing actually worked, consistently, over time.
The output of a readiness assessment done well isn't a red spreadsheet either. It's a gap memo that tells the organization exactly what an auditor will ask for, control by control, a specific population list, a sample of tickets showing separation of duties, the actual contract clause that's missing, plus a remediation roadmap prioritized by audit risk rather than by which spreadsheet row looks worst.
Stage three: the audit becomes preparation instead of a crisis
Organizations that go through this work before the audit stop panicking during it. The auditors don't ask "do you have MFA." They ask "show me every user with access to this system as of a specific date, and the ticket that approved any change made that week." An organization that has already had to answer that question internally, pulls a pre-organized evidence pack and answers in hours instead of days.
The distinction that matters
Three different questions get asked at three different stages, and conflating them is what gets organizations in trouble:
1. Self-assessment asks: do we believe our controls exist? 2. Independent readiness assessment asks: can someone outside the building challenge our assumptions before the audit does? 3. The SOC 2 examination asks: can the organization demonstrate, with evidence, that its controls meet the criteria?
A self-assessment can make an organization feel compliant. An independent assessment makes it actually prepared. The audit is what proves it to the customer that asked for the report in the first place. Skipping the middle step doesn't save time, it just moves the discovery of every gap into the audit itself, where the cost of finding out is much higher.
