Vanta SOC 2: What It Automates and How the Audit Works

If you are evaluating platforms, start with the SOC 2 software directory, Vanta profile, or Vanta review. This guide follows a company’s SOC 2 work from setup through the CPA handoff. Best SOC 2 compliance software by buyer fit compares Vanta with the other platforms we review. If Drata is on your shortlist, how the Drata SOC 2 audit works covers the same handoff.

What does Vanta do for SOC 2?

Vanta’s SOC 2 product page describes connected evidence collection, control monitoring, and an auditor workspace. These can reduce manual gathering and keep requests in one place. They do not prove that a control was performed correctly, that every system is connected, or that the CPA firm will accept the evidence. Check coverage against your actual system boundary and the firm’s requests.

The distinction matters for both Type 1 and Type 2. A Type 1 report addresses the design of controls at a point in time; a Type 2 report also addresses how they operated over a period. A Vanta status indicator is neither type of report.

How does a Vanta SOC 2 audit work?

A Vanta SOC 2 audit moves from agreed scope and control operation to evidence sharing, independent CPA testing, and a signed report. Vanta organizes the middle of that process; your team and the CPA firm remain responsible for their respective work.

1. Set the scope and date. Confirm whether the customer needs Type 1 or Type 2, which Trust Services Criteria apply, and the point-in-time date or Type 2 period. Define the product, people, infrastructure, vendors, and processes inside the system boundary with the CPA firm.
2. Connect systems and operate controls. Map each in-scope control to a Vanta test, an uploaded record, or a manual evidence method. Give each recurring control an owner and frequency. Compare connected records with the actual control calendar; a passing setting check may leave a monthly review or approval undocumented.
3. Agree on the auditor’s requests. Ask the CPA firm whether it will use Vanta’s default request list, supply a custom Information Request List (IRL), or work outside Vanta. Choose the auditor view before creating the audit, then test access and the evidence path.
4. Respond to testing and review the report. The firm examines the records and follows up on gaps. Your team supplies explanations, source populations, manual evidence, and management’s assertion. The firm decides what the evidence means and issues the report.

Vanta’s audit creation guide, updated September 30, 2026, says the framework, audit type, request-list type, auditor view, and default-list test-evidence setting cannot be changed after an audit is created. The audit firm can be added later, but once assigned it cannot be changed. Settle these choices with the firm before confirming the audit.

Choose the request list and auditor view before creating the audit

Vanta’s auditor-view guide, updated June 11, 2026, describes three combinations. The default request list is available on all plans; IRL and controlled-view features may require an upgrade or add-on. Check your entitlement and the firm’s preferred workflow before selecting one.

With Vanta’s default request list, the auditor gets either full or controlled population visibility. An imported IRL requires controlled view, with population pages hidden until your team enables them. The request-list choice also changes whether evidence syncs automatically or is attached to individual requests.

Default request listAvailable on all plans · evidence syncs automatically

Full view — Population pages are visible and fully explorable.

Controlled view, if enabled — Pages remain visible with limited attributes; individual pages cannot be turned off.

Custom IRLUpgrade or add-on · evidence shared per request

Controlled view only — Population pages start hidden. Your team enables the pages it wants the firm to see; visible pages show limited attributes.

With the default list, also decide whether the auditor can see the underlying records behind Vanta test results. Vanta says this test-evidence setting is enabled by default and cannot be changed after audit creation. With an imported IRL, the team attaches results to individual requests rather than relying on automatic test-evidence sync. A controlled view can require manual follow-up when the firm needs fields it cannot see.

Prepare the Vanta-to-auditor handoff

The handoff is ready when the CPA firm can inspect evidence for the agreed scope and period, including records Vanta did not collect. Engage the firm early enough to agree the evidence plan and testing calendar. Before testing begins, confirm that the Vanta workspace contains:

1. the approved system boundary and selected criteria;
2. current control descriptions, owners, and frequencies;
3. complete evidence populations from connected and manual sources;
4. records for the people, access, changes, incidents, training, risks, vendors, and other activities that apply to the controls;
5. a draft system description and a management reviewer; and
6. a record of control changes, failed tests, exceptions, and remediation.

If your plan includes IRL and the firm will work in Vanta, agree who uploads its information request list. Assign an owner and due date to each request. The firm may still request source records, complete populations, or evidence outside Vanta.

Adding a firm to the domain alone does not expose an engagement. Vanta’s auditor access instructions say individual auditors must also be assigned. Access starts with the observation window unless early access is granted. Preview the chosen view and ask an assigned auditor to confirm the engagement appears.

If you have not chosen a firm yet, start with one that already works in Vanta. In our directory, 40 CPA firms list Vanta among the platforms they work with. A listing does not show which request list or auditor view a firm prefers, so ask each finalist before you create the audit.

Example: trace a monthly access review to the auditor

Suppose your control says an owner reviews privileged users each month. This is an illustrative evidence check, not a claim that Vanta performs that review for you:

1. Source population: Export or identify all privileged accounts for the month, including accounts from in-scope systems Vanta does not connect to.
2. Vanta record: Find the connected account data or uploaded review record for the same month. A passing identity-provider configuration test alone does not show that the human review happened.
3. Management action: Preserve the reviewer, date, decisions, approvals, and follow-up on any inappropriate access.
4. CPA request: Match the firm’s requested period and population to what its Vanta view actually opens. If a field or source record is missing, assign an owner to provide it before sample testing.

The firm selects its own samples and decides whether the evidence is sufficient. This trace catches a common handoff gap: the platform may show a healthy technical setting while the requested human control record is incomplete.

What happens during testing and report review?

The CPA firm inspects evidence, selects samples, and follows up on exceptions under the agreed test plan. Your team answers requests and supplies missing or manual evidence. When both sides use Vanta, the workspace holds the shared requests and records. The CPA firm decides which evidence to test and what the results mean.

For a Type 2 report, controls must operate across the agreed period. The platform can preserve connected evidence during that period, but management must still perform the controls at their stated frequency. Timing depends on readiness, the period, the firm’s capacity, testing, remediation, and report review. See the SOC 2 audit timeline guide for the wider planning sequence.

Vanta pricing and the auditor’s fee depend on the offer. Vanta says its Seamless Audit package can include an independent auditor’s cost in one transaction; that does not change who issues the opinion. Confirm the quote’s scope and inclusions. Our Vanta pricing guide covers software and package costs in detail.

Is Vanta’s SOC report the same as yours?

No. Vanta’s Trust Center may provide information about Vanta as a service provider. Your company’s SOC 2 report covers the system your management describes and the controls your CPA firm examines. Using Vanta does not extend Vanta’s report to your organization.

The two reports can both matter. Your vendor-risk process may review Vanta’s report, while your SOC 2 engagement covers your own system. They have separate scopes, periods, management assertions, examinations, and opinions.

Vanta SOC 2 FAQ

Can my existing CPA firm audit me through Vanta?

Yes, if the firm is added to your Vanta domain and its individual auditors are assigned to the engagement. Vanta’s auditor access guide says you can request an invitation for a firm that is not listed. Confirm how the firm wants evidence shared before creating the audit; once an audit firm is assigned, it cannot be changed on that engagement.

How long does SOC 2 take with Vanta?

Vanta can reduce evidence-collection and handoff work, but it cannot set a universal timeline. Timing depends on scope, control readiness, remediation, the Type 2 period when applicable, CPA capacity, testing, exceptions, and report review.

Does Vanta’s price include the SOC 2 audit?

It depends on the offer. Vanta says its Seamless Audit package can include an independent auditor’s fee in one transaction. Confirm what the quote includes; the CPA firm’s examination remains independent.

Already using Vanta? Compare auditors experienced with Vanta or send one scoped brief to get matched with available CPA firms.