SOC 2 audits assess whether your systems meet the Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. Auditors look for evidence that you’ve implemented the controls you say you have – and that those controls actually work.
A software code audit prepares you for SOC 2 by reviewing the code-level implementation of your security controls and identifying gaps between what your policies say and what your software actually does. Going into a SOC 2 audit without knowing what’s in your code is a bit like studying for one exam and showing up to a different one.
Reference
SOC Suite of Services – AICPA-CIMA – aicpa-cima.com