Show HN: Ex-Deloitte auditor open-sourced the whole SOC 2 method for your AI | Hacker News Reader

Show HN: Ex-Deloitte auditor open-sourced the whole SOC 2 method for your AI

github.com

36 pointsyylyyl14 comments

Open articleView on HN

This is an incredible resource for someone trying to prep for an audit. Thank you!

Appreciate it! Happy to answer any questions.

I take it SoC does not stand for summer of code in this context?

https://en.wikipedia.org/wiki/System_and_organization_contro...

Perfect

I'm the author. CPA, spent 5 years doing SOC 2 fieldwork at Deloitte, recently started my own audit firm.

This repo is the methodology we actually audit against, not a summary of it: 86 controls, 355 test attributes with pass criteria, evidence standards, and the Type II testing method including how we call deviations, with worked examples. It's generated from the same JSON that drives our audit tooling, so it can't drift from what we actually do.

What "for your AI" means concretely: the framework is JSON rather than prose, so the controls, the attributes, their pass criteria and the evidence map are all machine-readable, and there's a file listing every tool our server exposes. It's CC BY 4.0 — point your own model at it and run your own readiness against the same bar the examination applies. The part that makes that work is 498 calibration examples: each one records a judgment call, the verdict an AI reached, the verdict that was correct, and why. Without those a model grades itself generously.

Why publish it: the audit criteria (AICPA's Trust Services Criteria) are public, but every firm's actual testing layer is a black box. A buyer holding two SOC 2 reports can't tell whether one auditor inspected evidence and the other just collected screenshots — the reports look identical. This year's Delve episode (hundreds of near-identical reports, procedures allegedly drafted before client evidence arrived — allegations Delve disputes) made that opacity harder to defend. Standards bodies publish their standards; we think the testing layer should be public too.

The thing that surprised us building it: sampling mostly shouldn't exist at small-company scale. Sampling exists in audit because looking at everything used to be expensive. At the company sizes we serve, populations are tiny — for most of our 79 sample-typed attributes, a proper sample would have been most of the population anyway — and AI collapsed the cost of looking at the rest. So the method defaults to testing complete populations, and sampling survives only as a disclosed fallback with hash-seeded selection that nobody (client, us, or either side's software) can steer.

Limitations, stated plainly: this is a methodology, not a track record. The firm is new — one Type I issued, no Type II yet. We published the method before the first Type II run on purpose, so it can't be quietly fitted to results afterward. Peer review: enrolled, first review due 2027.

Happy to answer anything about how SOC 2 audits actually work from the inside.

Is this how every auditor does though or just you/Deloitte? SOC 2 is a set of guidelines, not mandates, there is one size fits all and every org may design their own security controls based on their unique systems. Is that the same philosophy on the auditing side as well?

The method is mine. How I test, what evidence I accept, how I call a deviation. Every firm has their own methodology but none of them publish it.

Don't most people get the SOC 2 audit to also have credibility from a reputable firm? How valid would an AI SOC 2 audit be for marketing purposes

Your AI can read the open source methodology to get audit ready for you without relying on a compliance platform. The actual audit is done by a licensed firm.

I see now thanks

Thank you for sharing this, I have a question: can you tell us some lore behind SOC 2 certification, why is this certification is most frequently pursued by startups/tech companies?

Do all SOC 2 audit certifications worth the same, or some worth more, (big four vs smaller firm?)

Are there other/better alternative certifications that provide higher level of assurance to clients?

SOC 2 is almost a must-have for startups if they want to pursue enterprise deals. Not all soc 2 audits worth the same. People usually trust 2 types of audits: 1. a reputable name or 2. a transparent report that can show all the details like what evidence the auditor checks, how the auditor checks it, and what the auditor finds.

And soc 2 currently is the mostly widely accepted one. There are other more specialized ones for sure but not as universally accepted as soc2.

It's great to see SOC2 going in this direction. I've had to set up all kinds of compliance automation over the past decade (mainly Drata, Vanta, Oneleet), but at the end of the day it's a huge pain grabbing screenshots for what feels like a very performative process.

I asked a SOC2 auditor a while back about why they don't just make their own compliance automation dashboard, so we can pre-fill all their specific requests. They mentioned that certain rules are in place to separate evidence preparation from the actual auditing firms. However, after doing some armchair ChatGPT research, it seems like an audit firm could potentially be permitted to provide evidence management software, as long as you're not guaranteeing an audit result or preventing people from taking the evidence elsewhere. Perhaps you could shed light on the legal aspects and AICPA guidance here for providing evidence collection as AI skills to the companies you audit?

Reply on news.ycombinator.com