Drata SOC 2: Automation, Audit Evidence, and the CPA Handoff

For product coverage and buyer fit, see the SOC 2 software directory, Drata profile, and Drata review; for other platforms, see Drata alternatives or our guide to the best SOC 2 compliance software by buyer fit. If Vanta is also on your shortlist, how the Vanta SOC 2 audit works covers the same handoff. This guide follows the work after you have chosen a platform: scope, evidence, Audit Portal access, and the CPA examination.

What does Drata automate for SOC 2?

Drata’s SOC 2 product page describes connected evidence collection, control monitoring, and an auditor workspace. The useful coverage depends on the systems inside your audit boundary and the controls the CPA firm plans to examine. A connection may provide a current setting or account list without proving that a person approved a review, investigated an exception, or completed a manual control.

For Type 1, agree the point-in-time date and show the controls as of that date. For Type 2, agree the period and keep evidence that the controls operated throughout it. Drata can organize either engagement, but it cannot choose the CPA firm’s samples or opinion.

How does a Drata SOC 2 audit work?

A Drata SOC 2 audit moves from agreed scope and evidence mapping to control operation, an auditor handoff, independent CPA testing, and a signed report. Drata organizes records and requests throughout that work, while your team owns the controls.

1. Set the scope. Confirm the buyer’s Type 1 or Type 2 requirement, applicable Trust Services Criteria, system boundary, and date or period with the CPA firm. Do not treat Drata’s default in-scope controls as the final audit scope.
2. Map evidence to controls. Connect the relevant identity, cloud, code, HR, device, and ticketing systems. Assign an owner and evidence method to controls that Drata cannot monitor or that require a human decision.
3. Operate and check the controls. Perform reviews, approvals, assessments, and remediation at the stated frequency. Compare Drata’s records with the full source population and the agreed period.
4. Create the audit and assign the CPA. Set the framework and period, then check the request list, Audit Resources, and auditor access in the applicable Drata experience.
5. Answer requests and review the report. Supply complete populations, source records, explanations, and management’s assertion. The CPA firm performs the examination and signs the report.

Where can a ready status still leave an evidence gap?

Drata’s SOC 2 checklist, updated August 26, 2026, distinguishes monitoring tests from evidence for controls that are not monitored. It warns that some controls can appear ready because an approved policy is linked while still needing supporting records. Treat readiness as a queue for review: inspect the record, period, owner, and population behind each material control before the CPA requests it.

Which controls can read ready and still need an uploaded record?

Drata’s help article Are Your Controls Ready? (updated June 12, 2026) lists eight common controls that can appear READY once a policy is attached but still need an uploaded record to meet auditor expectations. The first two columns are Drata’s, shortened. The last three are ours: we matched each Drata control by name to the nearest control in our controls library, which is our reading of Drata’s names against our own control text and not a mapping Drata publishes. Use the library ID to ask your CPA firm what it will sample.

Drata’s own pages disagree on DCF-26. This article and its August 5, 2026 sibling, Example Evidence for Not Monitored Controls Linked to Policies, ask for the most recent test. The SOC 2 checklist, updated August 26, 2026, asks for the business continuity and disaster recovery plan. The table asks for the test: a plan shows what you intend to do, while a Type 2 sample asks whether recovery was tried during the period. Upload the plan as well, since BC-02 covers it separately.

The August 5 article lists the same codes under different titles in places, for example DCF-17 as Remediation Plan and DCF-22 as Network segmentation in place, so search your workspace by code. Drata calls these controls “common,” so the list is not exhaustive: a control missing here can still need an uploaded record.

Source: Drata Help Center, “Are Your Controls Ready? Understanding the Relationship Between Policies, Evidence, and Controls,” updated June 12, 2026, read October 21, 2026. Control names and upload requests are Drata’s wording, shortened. Library controls and the last two columns come from our controls library.

Example: check an access review’s date and population

Drata’s access-review instructions, updated September 17, 2026, say its User Access Review feature is an add-on for Foundation and Advanced and included with Enterprise. If your team uses it, select the applications, assign reviewers, record decisions and follow-up, and retain the completed evidence package. Confirm that manually added applications and unlinked users are accounted for.

The date needs special care: Drata says a review period does not snapshot access as it was during that period. If a review labeled April–June is completed on July 5, the reviewer sees access as it exists on July 5. If the CPA asks for the earlier population, check whether your source systems retain the historical records and provide them separately. A period label alone does not establish the earlier account state.

What should the CPA firm see in Audit Portal?

Drata’s Audit Portal guide, dated June 2, 2026, has separate instructions for the new and classic experiences. In the new experience, your team creates the audit, selects its framework and period, and assigns the auditor. The auditor then selects the client and engagement in Audit Portal and can see its request summary, request list, and Audit Resources. The customer and auditor work from the same underlying audit data and package sources; broader read-only access expands visibility without permitting edits.

Before testing, agree who owns requests and confirm these items from both sides:

1. the system description, criteria, Type 1 date or Type 2 period, and assigned CPA firm;
2. control descriptions, owners, and operating frequencies;
3. complete connected and manual evidence populations, with dates and source records;
4. exceptions, failed tests, remediation, and changes to controls; and
5. the request list and downloadable package the auditor will actually use.

Handoff test: Open one real request with an assigned auditor. Compare the framework and period, open the same evidence or package on both sides, then ask whether the record covers the requested population and period. If a requirement is hidden, Drata’s classic-experience troubleshooting steps say to check the auditor assignment, custom request list or default framework, audit period, and filters before calling it an evidence failure. Use the guide for your account’s interface version. In the new experience, Drata’s guide to audit date ranges and sampling, updated October 20, 2026, adds that auditors see only evidence that falls inside the audit date range and has been sampled, and that evidence attached to a request thread is not visible to them, so upload it to the control and mark the request Prepared.

If the firm works outside Audit Portal, Drata’s evidence-package guide, updated February 3, 2026, explains how to download an audit evidence ZIP with a searchable manifest and control-to-requirement mappings. Check that the exported package covers the agreed period and requests; send any missing source records separately.

What happens during testing and report review?

Use Drata’s audit workspace to track requests and responses. The CPA firm selects samples, evaluates exceptions, follows up on gaps, and reaches its own opinion. For Type 2, management must perform each control across the agreed period even if Drata retains connected records automatically. Readiness, the observation period, CPA capacity, testing, remediation, and report review all affect timing; the SOC 2 audit timeline guide covers that calendar.

Drata’s plan price does not establish the audit fee. Confirm what the CPA engagement includes and use our Drata pricing guide for dated software-cost evidence.

Does Drata issue a SOC 2 report for its customers?

No. Drata may maintain assurance documentation for its own service, but that documentation concerns Drata as a service provider. Your company’s SOC 2 report covers the system your management describes and the controls your CPA firm examines. Using Drata does not extend Drata’s report to your organization.

Your vendor-risk process may review Drata’s own assurance documentation while your SOC 2 engagement covers your own system. They have separate scopes, periods, management assertions, examinations, and opinions.

Already using Drata? Compare auditors experienced with Drata or send one scoped brief to get matched with available CPA firms.