Four weeks before our SOC 2 audit, what should we tackle first?

Start by getting management, your auditor, and whoever owns the system description in the same conversation. Confirm what is actually in scope and what kind of report you are pursuing. Do not assume the acquired team can simply be excluded. Scope needs to reflect how the service operates and what management represents, and a Type 2 period raises different timing questions from a point-in-time review.

Then make a short, documented remediation plan with owners and dates. If the current scope or timeline cannot support the report you want, discuss changing the scope or schedule with the auditor and leadership rather than presenting unfinished controls as complete.

I'd treat privileged access and the former employee account as the immediate fires. Disable access for anyone who has left, check identity systems, source control, cloud consoles, production, and communication tools, then rotate credentials they could have reached. A shared vault makes it harder to show who used a credential, so move production access to named accounts and individual permissions as soon as you can.

After that, inventory the remaining accounts and secrets. Anything exposed in plaintext or stored in places with broad access should be replaced, not just moved. Rewriting a file or repository does not make an exposed secret safe.

Don't turn the next four weeks into a big-bang migration. First get a reliable list of people, devices, accounts, repositories, and production access across both organizations. Close obvious leaver and excess-access gaps, then record what is still open and who is responsible.

Parallel pipelines are not automatically the first thing to consolidate. Focus on whether secrets are exposed, whether access is controlled, and whether changes are reviewed and traceable. A smaller set of well-understood controls with evidence is more useful than a rushed rebuild that nobody can explain.

Pull in the people who control budget and staffing now. These are acquisition integration risks, not a problem one person can quietly solve before an audit. Show leadership the gaps, the likely consequences, the work required, and the decisions they need to make about scope and timing.

Keep a dated record of the issues found, actions taken, and remaining remediation. Be candid with the auditor about the state of things. An audit is not a reason to relabel incomplete work as finished.

Check whether this is a new compliance effort or whether the acquired company already had controls or an audit history. Existing policies and evidence may help you understand the gaps, but they do not prove the current combined environment meets your controls. Use the control list to separate urgent access and credential risks from longer-term tooling cleanup.

For each control, note what evidence exists, what is missing, and whether the fix can be completed and demonstrated in time. That gives your auditor a concrete discussion rather than a last-minute guess.