This is the checklist for that side specifically. It won't make you SOC 2 compliant on its own, that also requires your security and infrastructure controls, but it covers every people-related control an auditor will ask about.
What auditors consistently test on the HR side
SOC 2 doesn't hand you a fixed checklist. It's a framework (the Trust Services Criteria) that an auditor tests your actual, written policies against. The people-related evidence an auditor consistently asks for falls into four areas.
- Hiring and onboarding. Background and reference checks performed and documented before start date. New hires complete security awareness training before or immediately after they get system access, not whenever they get around to it.
- Access and segregation of duties. No single employee has end-to-end control over a sensitive process (for example, the person who approves a vendor payment isn't also the person who can edit the vendor record unsupervised). Access levels are reviewed on a schedule, not only when something goes wrong.
- Offboarding and access termination. This is the control we see fail most often. You need a written policy stating a specific window (24 hours, 48 hours, whatever you commit to) for removing a departed employee's access, and for every termination in the audit period, evidence that it actually happened inside that window. If your policy says 24 hours and your actual practice is 48, that gap itself is a finding, even if 48 hours would have been fine as a stated policy. State a window you can consistently hit, then hit it.
- Documentation and training. An employee handbook covering your actual policies, a code of conduct, and documented proof employees acknowledged both. Ongoing security awareness training, not a one-time session at hire.
The readiness checklist
| Item | What the auditor wants to see | Where this usually breaks |
|---|---|---|
| Background checks | A record for every hire in the audit period, run before day one | Done for early hires, quietly skipped once hiring sped up |
| Security awareness training | Completion records, at hire and on a recurring cadence | Done once at onboarding, never repeated |
| Access termination policy | A written policy naming a specific time window | No written policy exists, access gets removed "eventually" |
| Access termination evidence | A ticket or log showing removal happened inside that window, for every termination in the period | Removal happens, but nobody logs when |
| Access reviews | A documented, scheduled review of who has access to what | Access is granted once and never revisited |
| Employee handbook | Current, covers actual policies, acknowledgment on file for every employee | Handbook exists but is two years stale, or acknowledgment isn't tracked |
| Org chart | Current reporting structure, matches reality | Exists in someone's head, not on paper |
How to close the gaps without overbuilding
Start with offboarding. It's the most commonly cited finding and the fastest to fix: write the policy, pick a realistic window, and start logging every termination against it starting today. You don't need twelve months of retroactive evidence to pass a Type 1 audit (a point-in-time assessment); a Type 2 audit (evidence over a period, typically three to twelve months) does require that history, so the earlier you start logging, the shorter your gap.
Don't build more than the framework asks for. A ten-person company doesn't need a quarterly access-review committee with a charter. It needs a recurring calendar reminder, a spreadsheet, and someone accountable for checking it. Auditors test whether the control exists and is followed consistently, not how sophisticated the tooling is.