Audit readiness roadmap
Prepared for a fictional B2B software company with 420 employees, preparing for its first SOC 2 Type II report and SOX IT general controls testing.
- Frameworks in scope
- SOC 2 Type II, SOX ITGC
- Systems
- Microsoft Entra ID, ServiceNow, Jira, GitHub, AWS
- Plan starts
- Nov 16, 2026
Change the date and every phase and due date below moves with it.
Where they stand today
From the intake questionnaire. Each control domain is rated by what the company said it already runs, and the plan below closes every gap.
The plan
Open any task to see what to do, where to do it in this company's own systems, and the evidence an auditor will ask for. Check tasks off to watch the leadership summary update.
One task, every framework it answers
The quarterly access review in Phase 2 is one piece of work. This company only needs it for SOC 2 and SOX today, but the same evidence carries into other frameworks if they add one later.
Every task in a roadmap carries this mapping, so a team never builds the same control twice.
| Framework | Requirement | Status |
|---|---|---|
| SOX ITGC | Access to programs and data: periodic review of user access | In scope |
| SOC 2 | CC6.2 and CC6.3: authorizing, modifying and removing access | In scope |
| ISO/IEC 27001:2022 | Annex A 5.18, Access rights | If added |
| PCI DSS v4.0.1 | Requirement 7.2.4: review user accounts and access at least every six months | If added |
| HIPAA Security Rule | 164.308(a)(4), information access management | If added |
| NIST SP 800-53 | AC-2, account management | If added |
How to read this roadmap
This roadmap is built from the information provided in the intake. It reflects the frameworks, audit date and current controls described there, and its accuracy depends on those answers.
It is a planning tool to help a team prepare, not a certification or a guarantee of audit results. Only an auditor can confirm whether controls meet a framework's requirements, so review the plan with yours before you begin.
Get a roadmap for your company
Answer the intake once and your plan is dated back from your own audit, with guidance for the systems you run. Roadmaps are $499 one time, or included in Premier from $1,990 a year.