CORAA

SOC 2 Readiness Checklist (Word)

Check readiness across scope, governance, risk, access, change, monitoring, incident response and the optional trust categories.

Free · CORAA original — SA-aligned
Updated 17 Oct 2026
Basis
Trust Services Criteria
Always in scope
Security
Report by
Independent CPA firm
Format
Editable Word
Share this template
Your firm — letterhead
Appears at the top of the document as the audit firm letterhead.
Used as the letterhead block.
Engagement details
The client and period this document is for.
What’s inside

An excerpt from the template.

SOC 2 Readiness Checklist — ___

Period / scope: ___ | Prepared by: ___ | Reviewed by: ___ | Date: ___

A readiness view against the AICPA Trust Services Criteria. Security is always in scope; availability, processing integrity, confidentiality and privacy are added if your commitments to customers need them. A SOC 2 report is issued by an independent CPA firm. This form helps you prepare and does not replace that work.

Type 1 looks at the design of controls at a point in time. Type 2 looks at how they operated over a period; agree the period with your auditor and customer.

↑ Excerpt only — the full template is what you download as Word
About this template

What you’re downloading, and when to use it.

This template follows the format published by the Institute of Chartered Accountants of India (ICAI) in the AASB Audit Working Paper Templates (June 2023), the authoritative reference for Indian statutory-audit documentation. Fill in your firm’s letterhead and the engagement details on the form above, click Download Word file, and you’ll get a fully formatted .docx ready to use.

Everything is generated in your browser and on a stateless API endpoint — no account, nothing stored on our servers. We’ll ask for a work email once before your first download so we can send you the file and the occasional relevant update; after that, downloads on this device are instant. Edit freely in Word, Google Docs or Pages before sending to your client.

Common questions

FAQs.

What is the difference between Type 1 and Type 2?
Type 1 looks at whether controls are suitably designed at a point in time. Type 2 looks at whether they operated effectively over a period.
Which trust categories must I include?
Security is always in scope. Add availability, processing integrity, confidentiality and privacy where your commitments to customers need them.
Related templates

You might also need.

SOX Risk and Control Matrix Template
Generate a SOX-style risk and control matrix with risk, assertion, control type, frequency, owner and evidence
Vendor Management Internal Audit Checklist
Free vendor management internal audit checklist. Tests vendor onboarding KYC, master data controls, price appr
Gap Analysis Template
Generate a gap analysis template with requirement, current state, gap rating, risk, action, owner and target d