How to use the SOC 2 Type II Audit Prep agent skill

What the skill makes the agent do

When the skill is active, the agent interrogates your SOC 2 Type II program rather than writing documentation for you. It works through six questions: what the scope is and which Trust Services Criteria (TSC) categories apply; whether any control skipped a cycle during the observation period; change-management evidence for controls added mid-period; where the exception log is and whether exceptions were assessed for materiality; sample evidence from the first month of observation; and the cross-walk to ISO 27001 and which evidence can be reused.

The output is a structured readiness report with observation-period status, exception log summary, evidence coverage by month, ISO 27001 reuse, audit firm readiness, a traffic-light verdict (ON-TRACK, NEEDS-ATTENTION or MATERIAL-RISK) and three recommended next actions.

The skill is a checklist and interrogation aid. It is not a substitute for an auditor or a compliance lawyer, and it does not produce an audit opinion.

Install the skill from the ZIP or the Claude apps

Option 1: download the ZIP from this page and unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill limited to one project.

Option 2: in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

The package contains a single file, SKILL.md. Its description begins with the command /compliance-os:soc2-audit-prep [scope].

Install the required scripts and plugin directory

The skill's workflow calls several Python scripts that live in referenced vendor paths. The SKILL.md refers to ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/soc2-compliance/scripts/, and to the compliance-os and ra-qm-team plugin directories. Those must be installed for the workflow to run. Copying SKILL.md alone is not enough for the script steps.

Trigger the skill with natural requests

You can invoke the skill with the command form or by describing what you need. The skill's own guidance says to run it before observation starts (months 1-2), at the mid-period checkpoint (month 6), before the field test (month 10), after the report when planning the next cycle, after a scope change such as adding a TSC category, and after a major incident during the observation period.

Phrases that should match the skill include asking for a SOC 2 Type II readiness check, a mid-observation checkpoint, or a pre-field-test readiness review. Include the scope you care about so the report is labelled correctly.

• "Run a SOC 2 Type II readiness check on our payments platform."
• "We're at month 6 of our observation period. Do a mid-period checkpoint."
• "Before the month 10 field test, challenge our SOC 2 evidence and exception log."
• "We're adding Confidentiality to our SOC 2 scope. What do we need to check?"

Prepare the input files

The workflow reads local JSON files that describe your current state, control program, evidence log and scope. The source does not define their exact schema, so check the vendor playbook referenced in SKILL.md before writing them. The skill does not verify evidence automatically; the agent reasons over the data you supply, so incomplete files produce an incomplete report.

• current_state.json: current compliance state for the gap analysis
• program.json: control program used to build the control matrix
• evidence_log.json: evidence records used for continuous tracking
• soc2_scope.json: scope used for the mock audit

Run the four workflow stages

The workflow runs in stages that match the observation timeline. Stage 1 is scoping and gap analysis before observation. Stage 2 builds the control matrix with the ISO 27001 cross-walk. Stage 3 tracks evidence continuously during observation. Stage 4 is a mock audit before the month 10 field test, which calls the audit_simulator.py script from a relative path outside the vendor folder.

Read the report and act on it

Start with the verdict. A red MATERIAL-RISK result or a yellow NEEDS-ATTENTION result should be read alongside the exception log and the per-control exception counts. The source notes that audit firms typically tolerate one or two exceptions per control, and treats three or more as a finding. Then work through the three recommended next actions, each with an owner and an observation-period timing.

• Check control operation for skipped cycles: quarterly controls across all four quarters, monthly across all months, annual within the period.
• Log each exception when it is discovered, with what, when, impact, remediation and owner.
• Front-load evidence in the first month rather than assembling it in the last 30 days.

Safety notes on scripts and network

The skill runs Python scripts, so review them before running them on your machine, and run them only against files you are comfortable exposing to a local process. According to the listing, the skill does not use the network. Your evidence and control files stay local unless you share them yourself. Treat the report as internal working material: it is a readiness view, not an attestation, and should not be sent to an auditor as if it were one.