To add to this, SOC1/SOC2 is only as useful as the security policies and standards and that assumes they were written around everything the company actually doe

To add to this, SOC1/SOC2 is only as useful as the security policies and standards and that assumes they were written around everything the company actually does. Auditors are only validating to some degree that you are doing what you say you are doing, but what you say you are doing may not be all-inclusive and respective of what you actually do.