I'm a recently hired (2 months ago) lead developer at a small (<50) fintech company. Tomorrow is our SOC 1 audit. A coworker is leading our company's interaction with the auditors; but, I've been brought in to assist with the many technical aspects of the SOC 1 audit. The problem is, after reviewing the agenda and requests, it has become exceedingly clear that we are grossly unprepared for the audit. We have little to no documentation, policies, or procedures. And what little we do have were never adhered to at all.
I've found that my answers to many of the requests are one of the following:
- I don't know (I've been here 2 months; everything SOC was defined a year ago).
- Check with [person] (who was here before me).
- Check with [entity] we outsourced management of [thing] to.
To me my responses feel like deflection and it feels like management may be setting me up for failure; but, I know my social reads may be off (I'm slightly autistic). Additionally, I've been advised to provide a positive spin in my responses tomorrow; but, I don't know how to do that given the situation. How do I best articulate the previous 3 points with a 'positive' spin?
Tomorrow, when the auditors come in, I know I will be asked to produce the technical documentation, policies, procedures, or be asked to perform procedures we outlined in the SOC1. How do I best articulate that the compliance to the SOC1 should have been handled by my predecessor and/or coworkers who've been here the for the last year without throwing them under the bus?
- I am making the assumption that my coworker is asking me, in good faith, to assist with the more technical aspects of the SOC audit. My coworker is similarly unprepared, but doesn't appear to be as agitated as I am by the scale of our unpreparedness. This coworker has asked me to provide technical assistance to other projects.
- I was never trained, introduced, nor on-boarded to our SOC compliance. I had to ask several times where our SOC compliance was so I may review it once I learned our SOC audit was coming up. (That was ~1 week ago).
- Full Disclosure: I'm slightly autistic. Responding to new social/professional situations is difficult for me. I freeze while I figure out what to do/say/respond. Contrasting this, when I do have experience, I respond to situations rapidly and strategically. In previous leadership roles that has empowered me to quickly take ownership during IT/software emergencies and otherwise manage subordinates effectively.
The Audit went much better than expected. The documentation we couldn't produced will be produced in their followup next quarter. Otherwise, my coworker handled the more difficult parts. Everything seemed to boil down to our small size and recent adoption of SOC 1.