SOC 2 controls do not map one-to-one with evidence items under the AICPA framework. A single control might need three pieces of evidence, and one evidence item might satisfy four controls. Managing these many-to-many relationships in spreadsheets is how compliance programs break down.
Evidence collection is the real bottleneck in SOC 2 Type 2 audits. At Tallyfy, an AI-assisted process with Playwright browser automation collected 99 evidence items across 4 sessions, using date-first naming conventions and typed evidence categories instead of expensive compliance platforms.
SOC 2 evidence collection is not intellectually hard. It is tedious, repetitive, and error-prone when done by hand. A Coalfire report found 60 percent of organizations still manage compliance with spreadsheets. The real cost is the organizational overhead of naming, tracking, and chasing sign-offs across 123 evidence items.