The two get used interchangeably and should not be. A gap assessment happens at the start of a program and asks “what does the framework require that we do not do?” A readiness assessment happens at the end and asks a different question: “when the auditor tests what we built, will it pass?” The first measures you against the standard; the second measures you against the examination. A control can clear the gap phase — it exists, there is a policy — and still fail readiness because it skipped two quarters or its evidence lacks timestamps and approvals.
A worthwhile assessment imitates fieldwork rather than reviewing paperwork: it pulls samples the way an auditor would, checks that evidence is complete for the period, rehearses walkthroughs with control owners, and confirms the system description matches the environment as deployed. The deliverable is a prioritized punch list of would-be findings — typically scheduled four to eight weeks before fieldwork so the fixes land in time.
For teams that want to run the exercise themselves first, our SOC 2 readiness checklist walks the same terrain in self-serve form.
Independence is the point. The person who built the program will unconsciously grade their own homework, reading intentions where an auditor will read artifacts. Use someone who tests programs for a living and was not involved in constructing yours — an outside consultant, a fractional security leader, or the audit firm in a separate advisory engagement. The assessment is only as valuable as its willingness to tell you things you would rather not hear with six weeks left to act.
