This is one of the most common calls we get.
A company went through the effort to get their first SOC 2 report. They hired a consultant, set up a GRC platform, wrote the policies, collected the evidence, survived the audit. Report issued. Celebrations. The sales team starts sending it to prospects. Deals close.
Then everybody goes back to building product. Nobody touches Vanta or Drata for 8 months. The policies don't get reviewed. The access reviews stop happening. The evidence monitors start failing and nobody notices. New tools get added without being scoped into the compliance program. Employees join and leave without the controls being documented. The risk assessment from last year still references a cloud environment that's been completely restructured.
And then the calendar reminder hits: your next audit window opens in 90 days.
Now you're scrambling.
How this happens
It's not negligence. It's the natural result of treating SOC 2 as a project instead of a program.
The first audit gets all the attention because there's a deal on the line or a customer requirement driving urgency. Everyone rallies. The consultant leads the effort. The team cooperates because there's a deadline and a clear business reason.
Once the report is issued, the urgency disappears. The consultant's engagement ends. The person who drove the project internally moves on to other priorities. The GRC platform becomes another tab nobody opens. The controls that were operating during the audit period start to drift because nobody is maintaining them.
This isn't unique to small companies. I've seen it at 200-person companies with dedicated security teams. The audit creates a burst of activity, and then the program goes dormant until the next audit approaches.
The problem is that SOC 2 Type II covers a continuous review period, usually 12 months. The auditor isn't just looking at your controls today. They're looking at whether your controls operated effectively throughout the entire period. If your access reviews stopped in March and the audit covers January through December, you have a 9-month gap that the auditor will find.
What the auditor sees when you've let things slide
Auditors are good at spotting programs that went dormant. Here's what they find:
Evidence gaps. Your policy says quarterly access reviews. The auditor asks for evidence from Q1 through Q4. You have Q1 (from the last audit push) and Q4 (from the current scramble). Q2 and Q3 don't exist. That's two exceptions on a single control.
Stale policies. Your information security policy references tools you no longer use, team members who left 6 months ago, and processes that have completely changed. Your AI governance policy doesn't exist because you started using AI tools after the last audit. Your vendor management policy lists vendors you've replaced.
Orphaned accounts. Employees and contractors who left during the dormant period still have active access to systems. The offboarding process worked during audit prep but nobody maintained it after the report was issued.
Unmonitored evidence. Your GRC platform shows 15 failing evidence monitors that have been red for months. Endpoint encryption checks failing because new devices were deployed without MDM enrollment. Access review tasks overdue. Training completion lapsed for recent hires.
Scope changes that weren't documented. You migrated from AWS to GCP. You added three new SaaS tools that process customer data. You launched a new product line. You started using AI in your workflow. None of this was reflected in your system description or control matrix.
Missing vendor reviews. Your vendor risk management control requires annual review of critical vendors' security posture. You reviewed them all during the first audit. None have been reviewed since. Three of those vendors have had security incidents in the interim that you don't know about.
What this means for your report
Exceptions in a SOC 2 report aren't the end of the world. We've covered that before. But there's a difference between one or two minor exceptions and a report that shows a pattern of controls not operating during the middle of the review period.
A few exceptions say: this company has a program, they had some gaps, they're addressing them. That's normal and most enterprise buyers understand it.
A pattern of dormant controls says: this company only does security when the auditor is watching. That's a credibility problem. Sophisticated buyers read the testing section of your report carefully, and a cluster of exceptions in the same time period tells a story about program maturity that no executive summary can fix.
In the worst case, if enough controls show gaps during the review period, the auditor may issue a qualified opinion. That's when the auditor says the controls were not operating effectively across the period. A qualified SOC 2 report is worse than no report at all in many procurement conversations because it explicitly documents the failures.
The 90-day scramble
Here's what happens when companies realize the audit is approaching and the program has been dormant.
Week 1 is panic. Someone logs into the GRC platform for the first time in months and sees a wall of red. Failed monitors, overdue tasks, missing evidence. They start assigning tasks to people who weren't involved in the first audit and don't know what they're looking at.
Weeks 2 through 4 are catch-up. Access reviews get done all at once. Policies get hastily updated. Evidence gets backdated or reconstructed from memory. New tools get added to the scope. The system description gets rewritten. Everything that should have happened over 12 months gets compressed into 4 weeks.
Weeks 5 through 8 are the audit itself. The auditor arrives and starts testing. They see that all the access reviews happened in the same 2-week window. They see policies with revision dates that are suspiciously recent. They see evidence gaps in the middle of the review period that no amount of last-minute work can fill.
The result: a report with more exceptions than necessary, a stressful audit experience, and a team that's exhausted and resentful of compliance. Then the cycle repeats.
How to break the cycle
The fix isn't complicated. It's just consistent.
Someone needs to own the program year-round. Not during audit season. Year-round. This person monitors the GRC platform weekly, ensures evidence is being collected, follows up on overdue tasks, coordinates access reviews on schedule, and keeps policies current. At most companies our size, this is a vCISO engagement, not a full-time hire.
Weekly touchpoints, not quarterly check-ins. A 30-minute weekly sync between the program owner and the internal team catches issues before they become gaps. A failing evidence monitor gets fixed in week 1, not discovered in month 9. A new tool gets scoped into the program when it's adopted, not when the auditor asks about it.
Treat the GRC platform as a live system, not an audit tool. Drata, Vanta, Rippling: these platforms are designed for continuous monitoring. They alert you when evidence fails, when tasks are overdue, when controls drift. But only if someone is watching. Check it weekly. Respond to alerts. Keep the dashboard green.
Schedule recurring controls in advance. Access reviews: put them on the calendar quarterly with a named owner. Vendor reviews: schedule them annually with due dates. Policy reviews: assign them when each policy is due for update. Risk assessment: block time annually. If it's on the calendar with a name attached, it happens. If it's not, it doesn't.
Keep your system description current. When your environment changes (new cloud provider, new SaaS tools, new product, new office, organizational changes), update the system description. Don't wait for audit prep to discover that your description no longer matches reality.
What we do for clients in this situation
This is one of our most common engagements. A company got their SOC 2, the program went dormant, and they need someone to come in, clean it up, and keep it running.
Here's what that looks like:
Kickoff. We get access to your GRC platform, your Slack or Teams, your ticketing system, and your key stakeholders. We assess where things stand: what's current, what's stale, what's broken, and what's missing.
Cleanup. We work through the backlog: failing evidence monitors, overdue access reviews, stale policies, untracked vendors, scope changes that weren't documented. We prioritize by what the auditor will test first and what creates the most risk.
Ongoing management. Weekly touchpoints with your team. We monitor the GRC platform, manage evidence collection, coordinate access reviews, keep policies current, handle vendor reviews, and prepare for the next audit cycle. When the auditor shows up, the evidence is already there, the controls have been operating all year, and the audit is a non-event.
Audit coordination. We work directly with your auditor. We prepare the evidence package, handle auditor requests, manage the timeline, and resolve any findings. Your team's involvement is minimal because the program has been running all year.
The goal is simple: your next audit should be boring. No scramble. No surprises. No late nights reconstructing evidence. Just a clean program that's been running consistently, documented properly, and ready for review.
What it costs
For most companies in this situation (20 to 150 employees, one or two frameworks, existing GRC platform), ongoing compliance management runs $3,000 to $5,000 per month. That covers the weekly monitoring, evidence management, access reviews, policy maintenance, vendor oversight, and audit prep.
Compare that to the alternative: a last-minute consultant engagement at rush rates ($15,000 to $30,000 for a compressed readiness sprint), a stressful audit with multiple exceptions, engineering time pulled from product work, and a report that doesn't reflect well on your program.
The monthly investment pays for itself in avoided scramble costs, cleaner reports, faster sales cycles, and a team that doesn't dread audit season.
The bottom line
Getting SOC 2 is the hard part. Keeping it is the discipline.
The companies that treat compliance as a continuous program close more deals, have cleaner reports, and spend less per audit cycle than the ones that sprint, rest, and scramble.
If your next audit is approaching and you're staring at a GRC dashboard full of red, we've been there before. We'll clean it up, get you through the audit, and keep it running so this doesn't happen again.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies.