Here’s who does what on the way to your audit report.
We’re using SOC 2 as the example. If your audit is ISO 27001 or HIPAA, you go through the same five phases.
Most of your part is approving drafts. The rest is running the controls you chose.
Your auditor’s testing comes at the end, in fieldwork.
| Phase | What you do | What your AI does | What Kanonik does | What your auditor does |
|---|---|---|---|---|
| Get set up | Connect your AI and choose SOC 2. Choose your audit firm, and work the dates back from when a customer needs the report. | Reads your cloud account, code and documents with the access you gave it. | Loads the SOC 2 criteria and starts your To decide list. | Agrees the scope, the report type and how long the observation period runs. |
| Draft your program | Read what your AI drafted and approve it, one request at a time. | Drafts your policies, controls and risks from what it can see. | Checks each draft and sends the weak ones back to your AI. | Nothing yet. |
| Close the gaps | Run the job Stress-test my controls, then approve the fixes your AI drafts. | Plays the skeptical auditor, then drafts the missing controls and policies. | Standing shows what’s covered and what’s still open, criterion by criterion. | Reviews your readiness, if you ask, with read-only access. |
| Run the observation period | Run your controls as written, and approve the evidence your AI finds. | Looks for new evidence and changes when you ask. | Records each item with the dates it covers. | Waits out the period you agreed, commonly 3 to 12 months. |
| Fieldwork and the report | Build the Sealed Audit Package, send it, and answer your auditor’s questions. | Lists anything an auditor would still ask for. | Seals the package. Your auditor gets read-only access while the engagement lasts. | Tests the controls, checks the package on their own computer and issues the Type II report. |
Read your program as of any day
Drag the date back to the day your period began. Kanonik reads the record as it stood on that day. Your auditor’s read-only seat reads it the same way.
SOC 2 TSC 2017 (rev. 2022)
61 criteria
- 50covered
- 10partly
- 0open
- 0only here
- 1not assessed
- 0not applicable
Common criteria, always in
Availability
Confidentiality
Processing integrity
Privacy
Select a criterion to read it.
Read as of 24 Sep 2026, as recorded 24 Sep 2026, by Dana Reyes
Nothing changed on this day. The last change was 20 Sep 2026.
Counts recorded work only. Covered means a satisfying control in place with dated evidence on the reading date. A partly link never covers.
During the observation period your week is mostly approval links and the controls that come due.
- Before the period starts
- Most of your hours go on drafting your program and closing the gaps.
- Monday
- Ask your AI what’s waiting. It works from Kanonik’s weekly summary.
- When a link arrives
- Read the drafts and decide on each one.
- When a control is due
- Run it, whether that’s an access review or a restore test. Your AI finds the evidence and drafts it for you to approve. A Type II report looks back over months, so we’d record evidence as it happens. Nobody should be rebuilding it the month before the audit.