Note: Review the introductory article on SOC 2 best practices and the associated SOC 2 workbook.
Hyperproof is a robust, all-in-one compliance operations platform that allows organizations to stay on top of all their security assurance and compliance work. With Hyperproof, organizations can identify compliance requirements, implement controls, collect and store proof, automate routine tasks, and much more.
Many organizations prefer to conduct their audits directly in Hyperproof to eliminate the typical back-and-forth between the organization and the auditor. Using Hyperproof also helps organizations greatly reduce the number of times clients are asked for the same evidence by different audit teams.
As an auditor, your role in Hyperproof varies depending on the client’s preferences—some clients may grant an auditor full access to their Hyperproof organization, while others may add an auditor as a contact, meaning that the auditor never actually logs in to the platform.
For auditors who are added to their client’s Hyperproof organization, you will be able to review all documentation the client has uploaded to Hyperproof, as well as communicate with the client right from the platform. Hyperproof keeps historical records with version control, so both you and the client can stay up-to-speed
with the audit in real-time.
Conducting a SOC 2 audit using Hyperproof
To begin your audit, engage an external auditor. The external auditor sends you a Document Request List (DLR) that they will use as the basis for the audit. See Creating an audit and importing a request list.
Creating the audit in Hyperproof
The auditor creates a new audit in Hyperproof and titles it. The title might be [YEAR] SOC 2 Type 2.
From the left menu, select Audits, and then click New.
Enter a name for the audit.
Click Create.
On the import window, click Skip.
Formatting the DLR as a CSV
To use the DLR sent to you by the external auditor, it must be in CSV format so it can be imported into Hyperproof when you create your audit.
From the left menu, select Audits, then select your audit.
Select the Requests tab.
Click Import.
Download the CSV template and update it with your requests. Be sure
to structure requests in the required format with the desired proof in the
descriptions and links to controls in the Control ID field.
Collecting and linking proof to requests
When you start collecting and linking proof to a request, change the request status to indicate you have started working on it. Link the necessary proof to each request. If you choose to use labels, those must also be linked to requests. Once proof has been linked to a request, change the request status to Submitted. See Linking proof to a request.
From the left menu, select Audits, then select your audit.
Select the Requests tab.
Assign requests manually or by bulk editing.
Change the request status to In Progress (this can also be done by bulk editing).
Link proof to the requests manually or via an existing task. If using labels, click Link label to link a label to the request.
After proof is linked, change the request status from In Progress to Submitted.
Exporting the audit and delivering it to the external auditor
You or your internal auditor can export the audit, download the ZIP file, and securely transfer it to the external auditor. Note that you can also invite your external auditor to Hyperproof, where they can log in to review requests and proof. See External auditors in Hyperproof and Documentation for external auditors.
To export audit information:
From the left menu, select Audits.
Select your audit.
Select ... (More Options), then click Export audit.
Reviewing and submitting follow-up actions
Once you have submitted all of your audit requests to the external auditor, they review the audit and determine if all of the requests have been addressed.
Reviewing follow-up actions
If all requests have been satisfied, your internal auditor moves on to the next steps.
If any requests remain unsatisfied, your internal auditor updates the Document Request List, ensures the linked proof is satisfactory, re-exports the updated audit, and then delivers it to the external auditor for another review.
Producing the SOC 2 Type 2 report
Once the external auditor has approved all requests in your audit, they produce a Type 2 report outside of Hyperproof.
Conducting a postmortem on your audit
You and your internal auditor meet to determine what succeeded, what failed, and what should be repeated in future audits.
Closing the audit in Hyperproof
Your internal auditor changes the audit status to Completed.
From the left menu, select Audits, then select your audit.
Select the Details tab.
Change the status from Active to Completed.