Muin is in private beta.Watch the public release announcement —talk to us.
Falaah Falaah AI

SOC 2 Audit

Prepare for SOC 2 audits with automated and manual evidence collection, a weighted readiness score, an AI evidence summary, and a scoped auditor portal.

The SOC 2 Audit module is the audit-preparation workspace. It aggregates evidence across your SOC 2 framework, tracks what’s automated versus what needs manual attestation, computes a weighted readiness score, and — when you’re ready — lets you invite your actual auditor to a scoped read-only portal where they sample evidence and sign off.

This page documents the audit-prep surface at /compliance/soc-audit. For the underlying framework and control model, see Compliance Frameworks.

The 51-Control Model

The default SOC 2 Type II import ships 51 controls across the five trust service categories. Of these:

  • 17 controls are covered by Muin’s automated evidence collectors — the platform gathers evidence automatically from the tenant’s data
  • 34 controls require manual attestation from the control owner — a HumanTask is emitted to the owner at audit-prep time

This 17/34 split is captured in the Plan 272 design as JG-1-51-CONTROLS and is the foundation of the audit-readiness workflow.

Automated Collectors (17 controls, 8 collectors)

The evidence collectors live at muin.server/src/services/compliance/evidence_collectors/:

CollectorControls coveredEvidence gathered
access_control.pyCC6.1, CC6.2, CC6.3User access lists, role assignments, offboarding logs
change_management.pyCC8.1Change-request records, deployment logs
incident_response.pyCC7.3, CC7.4, CC7.5Incident log, SLA compliance rates, post-mortems
monitoring.pyCC7.1, CC7.2Alert logs, uptime records, log retention
policy.pyCC1.4, CC2.2Active policies, acknowledgment rates
risk_management.pyCC3.2, CC3.4Risk register, mitigation plans
training.pyCC1.4Training completion, retraining cycles
vendor_assessment.pyCC9.2Vendor tiers, vendor risk assessments

Each collector is invoked by the audit service to assemble the evidence for its assigned controls. Evidence rows link back to source records (documents, log exports, incident reports) so the auditor can click through to verify.

Manual Fanout (34 controls)

The 34 controls without an automated collector need a human attestation — the control owner confirms “yes, we do X; here’s the evidence; here’s who owns it.”

When audit prep starts, the audit service (audit_service.py::_emit_manual_evidence_tasks) fanouts one HumanTask(category=CONTROL_EVIDENCE_REVIEW) per control without a collector. Each task:

  • Points to the control’s detail page
  • Carries the control’s description as context
  • Is assigned to the control owner (or compliance owner as fallback)
  • Is tracked in the audit readiness dashboard until resolved

Audit prep doesn’t move forward on those controls until the owner resolves the task with attached evidence.

Readiness Score and Threshold

On /compliance/soc-audit, the readiness card shows:

  • Overall readiness — 0–100 weighted aggregate of control statuses
  • Per-category breakdown — Security, Availability, Confidentiality, Processing Integrity, Privacy
  • Gap to ready — how many points short of the threshold
  • Audit-ready badge — green if above threshold, amber if within 10 points, red if further

The threshold defaults to 80 and is configurable per framework (Frameworks → SOC 2 detail → Readiness threshold). Adjust it based on your auditor’s standards — some audit firms expect 85 or 90 before they’ll begin on-site work.

What Drives the Score

The readiness score is the same compliance-score engine with SOC 2–specific framework data. Controls weigh by priority (1=highest through 5), and the score counts a control as “ready” if:

  • Status is implemented, tested, or certified
  • Evidence is attached within freshness window (default 90 days)
  • If linked to a policy, the policy is active with current version

Controls with not_started or in_progress status drag the score; controls in not_applicable don’t count either way.

AI Evidence Summary (Section 8.4)

On each control’s detail page inside the audit view, the AI Evidence Summary button invokes Bedrock Claude with:

  • The control description
  • The attached evidence metadata (document types, dates, linked tests)

It returns a concise narrative (“Evidence for CC6.1 includes 12 documents: 3 access review logs from Q1, 2 offboarding records, 7 onboarding checklists. Most recent evidence is 14 days old.”) suitable for the auditor package.

The summary_source Badge

Every AI summary shows a source badge:

BadgeMeaning
LLMBedrock Claude generated this summary from live evidence metadata
FallbackA deterministic rule-based summary fired because the LLM was rate-limited, timed out, or produced output that failed the citation fence

The citation fence rejects summaries that reference evidence document types not present for that control. You never see a summary claiming evidence that isn’t there.

Per-tenant rate limit: 15 summaries per hour. 24-hour Redis cache keyed on (tenant, control, evidence_hash) — so re-opening the same control serves cached output.

The Auditor Portal (IS4 / J10)

When you’re ready for the actual audit, Muin provides a scoped, read-only auditor portal. You invite your auditor by email; they get a signed magic link into a read-only view of your SOC 2 evidence.

Inviting an Auditor

On /compliance/soc-audit, click Invite Auditor. Fill in:

  • Auditor name and firm
  • Auditor email
  • Portal scope — typically all SOC 2 controls; can be narrowed to a trust service category
  • Expiration — how long the portal is valid (default 90 days, max 1 year)
  • Sampling permissions — can the auditor request specific evidence samples?

On submit, Muin:

  1. Creates an auditor_portal_token record with a cryptographically strong secret
  2. Emails the auditor a signed login link
  3. Records the invitation in the audit log

The Auditor’s Experience

The auditor logs in via the signed link and sees:

  • The SOC 2 framework detail (read-only)
  • Every control with its status, description, and attached evidence
  • Evidence documents (download-only; watermarked in the UI)
  • Readiness score + category breakdown
  • A Post Finding button per control — auditor can add inline notes for the control owner

Finding submissions trigger a notification to the control owner + compliance owner. The finding stays on the control until resolved (evidence updated, policy revised, or justification added).

E-Signature Signoff (coming soon)

When the audit is complete, the auditor clicks Sign Audit Report. Today this routes through the platform’s built-in acknowledgment flow:

  • The auditor confirms with type-your-name + timestamp + IP attestation
  • The tenant’s authorized signer (compliance owner) confirms the same way
  • The acknowledged PDF is stored in the Documents module as document_type=audit_report
  • The framework status transitions to certified, with the report attached as evidence

A legally binding e-signature option is on the roadmap — when it ships, audit signoff will route through that envelope flow with PKI-based digital signatures.

Token Revocation

Auditor portal tokens can be revoked at any time from the SOC 2 Audit page’s Active Auditor Sessions panel. Revocation is immediate — the auditor’s next click returns a 401.

Exporting the Audit Package (D2 via Intelligence Hub)

To export the audit package for offline review (e.g. for firms that want to ingest into their own workpaper system):

  1. Go to /intelligence-hub — the platform’s report runner (D2 integration)
  2. Select the SOC 2 Audit Package template
  3. Choose the framework + scope
  4. The export bundles:
    • Policy PDFs and current versions
    • Control descriptions and status
    • Attached evidence documents
    • Test history
    • Readiness score and history
    • Gap analysis with remediation notes
  5. Delivered as a ZIP or a single multi-document PDF

The CTA on /compliance/soc-audit deep-links into the Intelligence Hub with the SOC 2 template pre-selected — this is a guided-UX bridge per the platform-capability-first integration model (see the memory feedback_platform_capability_first). Reports live in one place (Intelligence Hub), invoked from many places (compliance, finance, HR).

Audit Evidence Status API

The GET /compliance/soc-audit/evidence endpoint returns the per-control evidence status across the SOC 2 framework:

FieldMeaning
control_idThe control’s ID
automatedWhether an evidence collector covers this control
evidence_countHow many evidence items are attached
evidence_fresh_countHow many are within the freshness window
latest_evidence_dateMost recent evidence timestamp
statusAggregate status (ready, needs_attention, missing)

This is the data feeding the readiness card’s detail view and the export bundle.

FAQs

How much evidence is enough?

Each control has an evidence count and a freshness window (default 90 days). A control is “ready” when it has at least one piece of fresh evidence. Your auditor may want more — some firms require multiple sample points within the audit period — and the auditor portal’s finding feature lets them request specific samples by comment. Start with “one fresh piece per control” and respond to the auditor’s specific asks through the portal.

Can I invite my auditor?

Yes — the Invite Auditor flow generates a scoped, read-only portal token. The auditor gets an email with a signed magic link, sees only what you’ve scoped (typically all SOC 2 controls), and can download evidence, post findings inline, and ultimately sign the audit report via the platform’s built-in acknowledgment flow (legally binding e-signature coming soon). Tokens expire after a configurable period (default 90 days) and can be revoked instantly. No auditor ever sees data outside the portal scope.

How do I export for the auditor?

Use the Export Audit Package CTA on /compliance/soc-audit — it deep-links into the Intelligence Hub with the SOC 2 template pre-selected. Choose framework + scope, and the Hub assembles a ZIP or multi-PDF containing policies, control descriptions, evidence documents, test history, readiness score, and gap notes. Use this for offline auditor firms that want to ingest into their own systems. For firms that’ll work in the Muin portal, the auditor portal invite is faster and keeps the data live.

What if a control has no evidence and no automated collector?

That’s the 34-control manual fanout. When audit prep starts, a HumanTask(category=CONTROL_EVIDENCE_REVIEW) is created for the control owner. The task surfaces on the owner’s compliance queue; resolving it (upload evidence, update status, write attestation) clears the task and the control moves toward ready. Audit prep’s readiness score penalizes unresolved tasks, so the dashboard surfaces which controls are blocking.

Does the AI evidence summary see my data?

Yes — Bedrock Claude receives the evidence metadata (document types, dates, linked tests) to produce the narrative, but it never sees the document contents themselves. The summaries cite only the metadata it was given; any claim outside that scope is rejected by the citation fence and replaced with a rule-based fallback (badge flips from LLM to Fallback). Tenants on strict data policies can disable AI summaries via module configuration.