Your SOC 2 Evidence Folder Has 47 Controls and 14 Are Overdue for Auditor Review

It is Monday, 10:22 AM. Your Head of Security opens the Vanta dashboard with the second coffee. The Type II observation window closes in 34 days. Forty-seven controls sit in scope. Fourteen read "evidence expired." Six read "auditor requested clarification" with the request timestamp 11 days old. Three read "control owner unassigned" against a former engineer who left in May.

She opens Slack and searches the #compliance channel for the last auditor thread. The Big Four senior sent a Level 1 request list on August 6th with 34 line items. Twelve items came back inside a week. Nine came back last Thursday with the wrong evidence attached. Thirteen sit open with no owner acknowledgment. The audit partner sent a soft-nudge email Friday asking whether the window still holds.

The founders in this seat keep opening a GRC Manager req at $145K and wondering why every audit turns into a Q4 fire drill. Compliance is not a headcount. Compliance is a rolling nine-stage queue that starts with a control mapped to a policy and ends with clean evidence attached to a workpaper an auditor signs. Six teams touch the queue and none of them own it end to end.

The 34-day path from auditor request to signed workpaper

Sort the last audit cycle by request-received date. Median days from auditor Level 1 request to attached-evidence-approved reads 34 days against a target of 7. Day one to day three belongs to the triage window, where the GRC lead reads the request list, forwards items to engineering, and drops the rest into a Google Sheet with a color code.

Day three to day fourteen belongs to the evidence collection, where the control owner opens the ticket, remembers the last screenshot went stale in June, opens the source system, takes a new screenshot, drops it into a shared drive folder, and pings the GRC lead in Slack. Day fourteen to day twenty-four belongs to the reformat cycle, where the auditor rejects the screenshot because the timestamp is missing, the user ID is redacted, or the export window does not span the observation period.

Day twenty-four through day thirty-four belongs to the escalation loop, where the CTO gets pulled into a Slack thread to approve a control exception, the GRC lead redrafts the memo three times, and the investor update references the audit status two weeks before the report ships. The pattern repeats every quarter, and the six-figure audit fee climbs 18 percent each cycle because the auditor books extra hours for chase work.

Stage one: the control-to-owner map that lives in a stale sheet

Open the control matrix. Forty-seven controls in scope for the Type II. Twelve name a control owner who left the company since the last audit. Eight name a team, not a person, so the ticket sits in a Jira board nobody triages Wednesdays. Six name the CTO as the fallback, which routes every request into one calendar that already runs at 94 percent utilization.

The Series B version of this function reads the org chart, the identity provider, and the last cleared workpaper against the control matrix every Monday. Reassigns orphaned controls to the current owner of the underlying system inside 24 hours. Blocks the audit kickoff until every control in scope has a named human, a backup human, and a system of record identified against the evidence type.

Ships the ownership map into the auditor's request tracker before the Level 1 list arrives, not two weeks after. The auditor sends the Level 1 request to the named human with the last cleared evidence attached as context, and the triage window collapses from three days to four hours. Same GRC lead, same headcount. The security questionnaire queue already exposed the same pattern against buyer procurement.

Stage two: the evidence collector nobody built

Every request cycle ships the same seven evidence types across the same six source systems. Access reviews from Okta. Change tickets from Jira. Deployment logs from GitHub Actions. Backup verifications from AWS. Vulnerability scans from Snyk. Termination checklists from Rippling. Vendor SOC 2 reports from the procurement folder.

The stuck version has an engineer take a screenshot every quarter, drop it into a shared drive, and hope the timestamp reads inside the window. The Series B version reads the auditor's request against a library of 34 evidence templates the last two audits closed. Pulls the export from the source system with the observation window, the user identifier, the change ID, and the timestamp already stamped in the file name.

Attaches the evidence to the workpaper in Vanta or Drata with the metadata schema the auditor's tooling expects. Flags any export that returns zero rows for the control owner to investigate the same day, not the day the auditor writes the exception memo. Nine reformat rounds collapse to zero. The auditor opens the workpaper and the evidence lands in the expected shape on the first pass.

Stage three: the auditor communication loop that runs on lag

Every audit cycle produces 40 to 60 auditor questions across the observation window. The stuck version parks each question in the auditor's PBC tracker and the GRC lead checks it Thursday morning. Median response time reads 6 days. The auditor writes the exception memo on day 7 and the CTO gets pulled into a Slack thread to sign off on remediation on day 9.

The stage-three function reads the PBC tracker every hour against the control-owner map. Routes new questions to the named human in Slack inside five minutes with the last cleared workpaper, the current evidence attempt, and the auditor's exact language quoted. Drafts a first-pass response against the control library and the prior year's cleared workpaper for the owner to review, not to write from scratch on Tuesday afternoon.

Escalates any question sitting more than 48 hours to the CTO with a two-sentence summary, the blocking dependency, and the remediation path. Median response collapses from 6 days to 14 hours. The auditor closes the observation window on schedule and the report ships two weeks earlier. The audit fee stops climbing because the auditor's staff hours stop compounding on chase work.

The unit economics of a GRC Manager hire against an agent stack

Run the two paths against the GRC Manager req sitting in the drafts folder at $145K base plus 12 percent bonus. Path A closes the req in October, ramps the hire through Q1, and adds a second GRC body to the team owning SOC 2, ISO 27001, and vendor reviews. Loaded year-one cost lands $198K to $245K. Median request-to-evidence lag moves from 34 days to 22, the observation window still closes late, and the audit fee stays at $84K plus a $12K chase-hours line item.

Path B ships a three-sprint fractional AI compliance function at $72K to $108K in build across the first 60 days and $5K to $7K a month to run. Sprint one lands the control-to-owner map against the identity provider and the org chart. Sprint two lands the evidence collector against the seven templates and the six source systems. Sprint three lands the auditor communication router against the PBC tracker and Slack.

The fractional AI department runs the compliance queue on the cadence the auditor's tooling runs, not the cadence a human GRC lead can chase. Loaded year one lands $132K to $192K plus a fractional Compliance operator at $6K a month who owns policy judgment, exception memos, and the auditor kickoff call. Median request-to-evidence lag collapses from 34 days to 4. The audit fee drops 22 percent because the auditor stops booking chase hours. The 14-day sprint that stands up the evidence collector costs less than one cycle of the current audit's chase-hours line item.

The four numbers a security lead runs before the next GRC req

The founders reading this are three weeks from posting a GRC Manager req on the strength of a "we need to scale compliance" narrative. Before the offer letter goes out, run four numbers against the compliance function, not the headcount. Score the queue, not the hire.

Auditor request-to-evidence days. Measure the median days from a PBC request landing in the auditor tracker to attached evidence approved. A healthy function runs under 7 with owners routed inside the hour. A stuck function runs 25 to 45, and the auditor writes the exception memo before the owner opens the ticket.

Orphaned control percentage. Divide the controls in scope with no named human owner in the current org chart by total controls in scope. A healthy function runs zero on the Monday before audit kickoff. A stuck function runs 15 to 30, and six controls route to the CTO as the fallback owner.

Evidence reformat rate. Divide the evidence items the auditor rejected for format, timestamp, or window mismatch by total evidence items submitted in the cycle. A healthy function runs under 5 percent. A stuck function runs 25 to 40, and the observation window closes with three controls still open.

Audit fee change year over year. Divide the current audit invoice by the prior year's invoice against the same scope. A healthy function runs flat or down as the auditor's staff hours drop. A stuck function runs up 15 to 25 percent, and the fee growth funds the auditor's chase hours, not new scope. Any two numbers in the stuck zone means the queue is the problem, and you can scope the compliance function in a 30-minute call this week.