What to do when unprepared for a SOC audit

Question

Background

I'm a recently hired (2 months ago) lead developer at a small (<50) fintech company. Tomorrow is our SOC 1 audit. A coworker is leading our company's interaction with the auditors; but, I've been brought in to assist with the many technical aspects of the SOC 1 audit. The problem is, after reviewing the agenda and requests, it has become exceedingly clear that we are grossly unprepared for the audit. We have little to no documentation, policies, or procedures. And what little we do have were never adhered to at all.

I've found that my answers to many of the requests are one of the following:

1. I don't know (I've been here 2 months; everything SOC was defined a year ago).
2. Check with [person] (who was here before me).
3. Check with [entity] we outsourced management of [thing] to.

My Questions

To me my responses feel like deflection and it feels like management may be setting me up for failure; but, I know my social reads may be off (I'm slightly autistic). Additionally, I've been advised to provide a positive spin in my responses tomorrow; but, I don't know how to do that given the situation. How do I best articulate the previous 3 points with a 'positive' spin?

Tomorrow, when the auditors come in, I know I will be asked to produce the technical documentation, policies, procedures, or be asked to perform procedures we outlined in the SOC1. How do I best articulate that the compliance to the SOC1 should have been handled by my predecessor and/or coworkers who've been here the for the last year without throwing them under the bus?

Additional Notes

1. I am making the assumption that my coworker is asking me, in good faith, to assist with the more technical aspects of the SOC audit. My coworker is similarly unprepared, but doesn't appear to be as agitated as I am by the scale of our unpreparedness. This coworker has asked me to provide technical assistance to other projects.
2. I was never trained, introduced, nor on-boarded to our SOC compliance. I had to ask several times where our SOC compliance was so I may review it once I learned our SOC audit was coming up. (That was ~1 week ago).
3. Full Disclosure: I'm slightly autistic. Responding to new social/professional situations is difficult for me. I freeze while I figure out what to do/say/respond. Contrasting this, when I do have experience, I respond to situations rapidly and strategically. In previous leadership roles that has empowered me to quickly take ownership during IT/software emergencies and otherwise manage subordinates effectively.

Update:

The Audit went much better than expected. The documentation we couldn't produced will be produced in their followup next quarter. Otherwise, my coworker handled the more difficult parts. Everything seemed to boil down to our small size and recent adoption of SOC 1.

Answer 1

As an IT auditor who is very familiar with SOC 1 / SOC 2 audits, I will answer from experience.

As you are undergoing an SOC 1 audit, your company as a service organization must be providing serivices for which your clients rely on for their accurate financial reporting. Your senior management should have prepared an statement of assertions about what services your organization is providing and how such services are provided. Ultimately, senior management signs off on the assertions for the external auditors, not yourself, so this fact alone may somewhat calm your nervousness. If there are any deficiencies noted by the auditors, again it is senior management who will have to provide a management's response.

Before I explain how to best work with an auditor, I will tell you what Not to do.

Do not try to deceive or seem like you have something to hide

If you do not know how to answer a question, it is perfectly OK to ask the auditor for clarification, or examples of evidence presented in the past if available, such as from past SOC 1 audits done. What you don't want to do is to deliberately present misleading or outright false information in the hopes of outsmarting the auditor. In all likelihood, the auditor will be more skeptical and probe deeper for the information requested. I know I would if management did this to me.

Do not expect auditors to accept evidence from oral interviews alone

Evidence gathered from inquiry is less persuasive than the same evidence in written form - section 2.3.2 from link. A good auditor will and should corroborate any evidence gathered through inquiry with another evidence gathered from a more persuasive method, such as inspection of documentation.

Do not try to delay the security auditor or expecting they will forget request made

When I complete a security audit, I always keep meticulous work papers indicating closed and open items. If you think that intentionally delaying providing me what I requested will result in me "forgetting" the request, the tactic will not work.

How do I best articulate the previous 3 points with a 'positive' spin?

I recommend your second method. Accept you don't know the answer, but refer the auditor to whoever you feel would be best able to help, such as a senior team lead, or your manager.

I would strongly caution against your third method. You can delegate the responsibilities to a vendor, but you cannot delegate accountability for performance. It is your management who is ultimately responsible for third party vendor / risk management. If I were to hear such a statement, it would be a strong red flag for me, as it indicates poor senior management accountability at the entity level (tone at the top).

As to how to answer questions from an auditor, the suggestions below should be helpful:

Do not volunteer extra information

Answer directly, and only give what is asked. If the auditor does not feel your response is sufficient for assurance, he / she will followup, which at that point, you can elaborate on your previous response.

If there is mitigating information that would help avoid or reduce the severity of findings, let the auditor know.

For example, if the auditor discovers deficiency in system access, if such access required another prerequisite condition to be true, tell the auditor such.

Let management know early if you anticipate a particular area will have heavy findings

Management should appreciate the extra time for them to prepare the best defense possible, or if the finding is legitimate, to remediate the issue found before the audit report is issued by the auditor.

Try to work with the security auditor to the degree possible so as to reduce audit findings / adverse opinion to observations or a qualified opinion

Whereas audit findings usually indicate that one of the SOC 1 principles is not met in entirety or the controls as designed are not operating effectively, audit observations usually indicate documentation issues with the performance of a control. The control may be in place and operating appropriately, just that the control documentation to support its performance is not optimal.

In a similar manner, qualified opinions indicate that controls are not suitably designed or operating effectively in for one particular SOC 1 objective or a specific element of the management description of services provided.

Answer 2

I don't know the answer to that. Let me track it down and get back to you.

That is a good answer to use. If you don't know, you need to find out and let them know, right? And that doesn't throw anyone under the bus. Take down notes of all questions that you can't answer, and then go find the answers.

That also allows you to ask someone with more experience how to answer when the answer appears that you are not compliant.

At some point, they may get tired of hearing the same "I don't know" answer, but point out that you are new, and it's simply going to take a bit longer until you know the systems better. If you are able to get some answers back to them fairly quickly, they will realize this process is working, in spite of your inexperience.