Instead of a six-week scramble before the audit, Make now pulls SOC 2 evidence on a schedule — access reviews, backup logs, training completions — filing everything into a structured audit folder and pinging owners only when something is missing.
Typical results
94%
Evidence collected automatically
14 hrs
Engineering time, was 120
365
Days of continuous evidence
Figures reflect typical results for this kind of automation.
The challenge
Facing its first SOC 2 audit, the team discovered evidence collection meant screenshots from cloud consoles, exports from HR and ticketing tools, and endless Slack messages asking who owned what. The dry run consumed six weeks and roughly 120 engineering hours — and still surfaced gaps days before the auditor arrived.
Before and after
Audit prep time
−90%Evidence gathered manually
−94%Engineering hours per audit
−88%The automation
We built Make scenarios that collect evidence continuously from the systems where it lives: access reviews and permission snapshots from cloud consoles, backup and monitoring logs, onboarding and security-training completions from HR tools, and change tickets from the tracker. Every artifact is timestamped and filed into an audit folder structured by control. When something is missing or stale, only its owner gets pinged — with exactly what's needed.
How it works
- 01
Evidence on a schedule
Make pulls access reviews, backup logs and training completions from each system automatically.
- 02
Filed by control
Every artifact is timestamped and dropped into an audit folder structured by control.
- 03
Gaps get pinged
Owners are notified only when something is missing or stale — with exactly what's needed.
- 04
Coverage builds all year
Evidence accumulates continuously instead of piling up in the quarter before the audit.
- 05
Auditor-ready handoff
The auditor receives a complete, control-mapped folder on day one.
Starts from
- Cloud consoles & logs
- HR & ticketing systems
Delivers
- Structured audit folder
- Missing-evidence pings
- Audit-ready controls
The impact
Audit preparation collapsed from six weeks to four days, with 94% of evidence collected automatically all year round. Engineering time on the audit dropped from 120 hours to 14, and the auditor received a complete, control-mapped folder on day one — no gaps, no scramble, no all-nighters.
Questions about this automation
Which systems can evidence be collected from?
Typical sources are cloud consoles for access reviews and permission snapshots, monitoring and backup logs, HR tools for onboarding and security-training completions, and the ticketing system for change records. Make connects to each one through its API on a schedule, so evidence is collected where it already lives.
How is evidence organized for the auditor?
Every artifact is timestamped and filed into a folder structure that mirrors the control list, so each control has its own evidence trail. Because collection runs all year, the auditor receives a complete, control-mapped folder at the start of fieldwork instead of screenshots gathered at the last minute.
What happens when evidence is missing or out of date?
Each control has an owner and an expected frequency, such as a quarterly access review. When an item is missing or older than allowed, only that owner gets a message stating exactly what is needed and by when. Items still missing after a reminder are escalated to the compliance lead.