SOC 2 audits assess whether your systems meet the Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. Auditors look for evidence that you’ve implemented the controls you claim to have – and that those controls actually work.
A software code audit prepares you for SOC 2 by reviewing the code-level implementation of your security controls. It identifies gaps between what your policies say and what your software actually does. Going into a SOC 2 audit without knowing what’s in your code is a bit like studying for one test and showing up to a different one.
Reference
System and Organization Controls (SOC) – AICPA – aicpa.org