SOC 2 Audit Evidence Collection Tracker

Tracks each in-scope SOC 2 control against its required evidence artifact, control owner, collection cadence, and observation-period status to support audit readiness and evidence completeness.

Inspection Details

• Observation period start date
  Start date of the SOC 2 observation period being tested.
• Observation period end date
  End date of the SOC 2 observation period being tested.
• In-scope Trust Services Criteria identified
  Select the Trust Services Criteria in scope for this evidence tracker.
• Audit owner / coordinator
  Name or role of the person coordinating evidence collection.

Control-to-Evidence Mapping

• Control identifier
  Unique control ID or reference used in the SOC 2 control matrix (for example, CC6.1 or A1.2).
• Control description matches the control matrix
  Brief description of the control being evidenced; should align to the approved control matrix and Trust Services Criteria mapping.
• Required evidence artifact identified
  Specific artifact required to demonstrate the control operated during the observation period (for example, access review report, change ticket, backup log, incident record).
• Evidence owner assigned
  Person, team, or role responsible for producing and retaining the evidence artifact.
• Collection cadence defined
  How often the evidence must be collected during the observation period.
• Evidence collection status
  Current status of evidence collection for this control.
• Evidence file or repository link
  Link to the stored evidence file, ticket, repository, or document location.

Evidence Quality and Completeness

• Artifact covers the full required period
  Evidence spans the correct date range for the observation period or required sampling window.
• Artifact is attributable to the control owner
  Evidence clearly shows who performed, reviewed, or approved the control activity.
• Artifact is legible and complete
  Evidence is readable, unredacted as appropriate, and includes all pages, fields, or log entries needed for testing.
• Evidence supports the stated control operation
  The artifact actually demonstrates the control operated as designed, rather than only showing a related activity.

Exceptions, Gaps, and Follow-Up

• Missing evidence items identified
  Count of in-scope controls or samples with missing required evidence.
• Open exceptions documented
  Any known exceptions, deficiencies, or non-conformances are documented with remediation status.
• Corrective action owner assigned
  Name or role responsible for resolving evidence gaps or updating the control artifact.
• Target remediation date
  Planned date to resolve the evidence gap or collect the missing artifact.

Attestation

• Inspector attestation
  Inspector confirms the evidence tracker entry is accurate to the best of their knowledge.
• Final review notes
  Optional summary of unresolved items, assumptions, or auditor follow-up points.