Three weeks before fieldwork, someone is at their laptop at 11pm pulling screenshots out of Microsoft 365.
They are chasing managers for overdue access reviews. Reconciling the employee list against active accounts. Hunting for vendor SOC reports. Working out why someone who left in August still holds a license somewhere. Writing down processes that have existed informally for two years but were never documented, and trying to explain the gaps where evidence should be.
None of that work is making the company more secure. It's reconstructing proof that controls were operating during a period when nobody was capturing proof.
Meanwhile the normal work hasn't stopped. There are still tickets, still onboarding and offboarding, still projects and security alerts and users who need help. SOC 2 becomes a second job layered on top of the first, assigned to the same people.
What the scramble is actually made of
The failure has recognizable parts, and naming them helps because each one has a different fix.
Evidence scavenging. Manually locating screenshots, logs, tickets, approvals, and configuration evidence across a dozen systems, none of which were set up to produce evidence on request.
Retroactive documentation. Writing policies and procedures to describe how things are already done, under time pressure, by someone who has to guess at parts of it.
Access cleanup. Discovering stale accounts, permissions nobody can justify, missed offboarding steps, and access reviews that were skipped, then trying to resolve all of it at once.
Control archaeology. Attempting to prove something happened six months ago when nobody captured evidence at the time. This is the one that most often ends in a finding, because some of it genuinely cannot be reconstructed.
Cross-functional chasing. Repeatedly asking HR, finance, leadership, and engineering for approvals and evidence, from people who have their own deadlines and no particular stake in your audit.
Audit-driven remediation. Finding a control gap during readiness and trying to redesign the process while simultaneously producing evidence for the process you're redesigning.
Underneath all six is the same constant context switching, because the people who keep the technology running are the same people answering compliance requests.
The burnout isn't caused by SOC 2
It's caused by treating SOC 2 as an event instead of an operating model.
Access reviews, onboarding and offboarding, vulnerability management, vendor reviews, backup testing, incident management, change management, and evidence collection all have to happen anyway. The only real variable is whether they happen throughout the year as part of how the company operates, or whether they get compressed into the six weeks before fieldwork.
When those things run year-round, the weeks before fieldwork are validation and organization. When they don't, those weeks become an attempt to recreate a year of governance out of emails, tickets, spreadsheets, screenshots, and people's memories.
Type I and Type II, and why the difference matters for planning
Auditors commonly take organizations through a Type I first and a Type II afterward, and the distinction is worth understanding before you plan anything.
A Type I is a point-in-time assessment. It examines whether your controls are suitably designed as of a specific date. It happens once.
A Type II examines whether those controls operated effectively across an observation period. That's the ongoing one, and it's the one customers usually want to see.
The planning consequence is that a Type II is testing a stretch of your history. Evidence has to exist from throughout the window, not assembled at the end of it. This is why control archaeology is so painful and so common: it's a Type II requirement being met with a Type I mindset.
What readiness actually looks like
The sequence is consistent even though the timeline is not. Gap assessment, remediation, the evidence period, then the audit.
How long each takes depends entirely on the complexity of the environment and how far from the target the organization starts. A company with mature IT operations and a few documentation gaps is on a different schedule than one where nobody has ever run an access review. Anyone offering you a standard timeline before looking at your environment is guessing.
What does hold across engagements is that the remediation phase is where the real work sits, and that it goes faster when the controls are being built into operations rather than bolted alongside them.
The work that has to run year-round
Most of what a SOC 2 program requires is operational rather than compliance-specific, which is why it belongs in the day-to-day rather than in a binder.
Access requests and approvals need to run through a process that captures who approved what and why, so that onboarding and offboarding produce evidence as a by-product rather than requiring reconstruction later.
Credential management has to be enforced and observable, so that the answer to who had access to what is a report rather than an investigation.
Device management has to produce a trustworthy inventory, which is easier to maintain by enforcing enrollment than by reconciling spreadsheets.
Backup and restore testing has to actually be performed and dated, because the Availability criteria require testing rather than intention.
And where a compliance automation platform is in play, it needs process behind each control it monitors, or it produces a readiness score that doesn't survive contact with an auditor.
None of those are audit tasks. They're operations tasks that happen to produce audit evidence when they're run properly.
Where we sit
We don't perform audits and we don't sell them. We work with whichever auditor a client has or chooses, and the relationships we've built across firms exist because of the work rather than the other way around. That independence matters: our job is to get you ready for the audit, not to have an opinion about who conducts it.
What distinguishes this from a readiness consultancy is that we operate the controls rather than assessing them and leaving. A gap assessment tells you that access reviews aren't happening. It doesn't make them happen. We're already running the help desk, managing identity and endpoints, and monitoring backup, so the evidence accumulates as part of work that has to be done regardless.
That's the whole argument for continuous compliance, stated plainly. The work is the same either way. Doing it as you go costs less than doing it at 11pm in the third week of January.
If you're heading toward a first audit or maintaining an existing report, that's the practice we run.