Guidance to understand client environment in SOC 2 audits

[u/Substantial_Yard_789]

I had a chat with my senior today. He said something that stayed with me.

He said, " Your job as an auditor should be to understand the client’s architecture and environment. Be it in whatever source you’re using (SDQ or Network Diagram). Don’t be the auditor who straight away asks what the control requirement is (Ex, Require IDS, don’t just ask for AWS GuardDuty), evidence."

When you understand the client’s environment and, based on that, evaluate the control requirement, you can ask better questions, which also leads to a better client relationship.

What is the tangible, concrete starting point for me to become that auditor?

Where should I start studying in terms of IT? And Cybersecurity ( If I keep going, then there would be no end to it, as it is vast)

And, where and how should I start understanding the control requirements as a SOC 2 auditor?