FAQ: Do changes to compliance scripts and automation rules need review?

Treat changes according to their risk and the role the automation plays. A script that prepares an audit population or a rule that disables accounts can materially affect records or operations. Keep a change history, an owner, appropriate approval, and test results that show the expected outcome. Preserve the version used for important runs so an unexpected result can be investigated later. Avoid making unrecorded changes during fieldwork just to produce a desired status. The review can be proportionate, but the team should be able to explain what changed, why, and how it was checked.

Related: SOC 2 audit and compliance hub.

Further reading: NIST automated control-assessment guidance; NIST control-assessment guidance.

Additional FAQs

What is SSAE 18 (formerly SSAE 16)?

SSAE No. 18, Attestation Standards: Clarification and Recodification, clarified and recodified the AICPA attestation standards. It superseded SSAE No. 16 and other earlier standards, with specified exceptions. It covered more

Are the proposed 2027 SOC 2 criteria final requirements?

No. As of October 30, 2026, the AICPA's proposed 2027 Trust Services Criteria and Description Criteria are exposure drafts, not final requirements. The announced comment deadline is January 15, 2027.

What should we reassess before enabling AI in an existing product?

Check what the AI feature changes from the product you already approved: Confirm the actual settings and relevant terms. Test the intended use with suitable non-sensitive examples, then record the

Are Representation Letters Required in SSAE 18?

Yes. For SOC 1 examinations, the applicable AT-C requirements call for management’s written representations. This was not entirely new with SSAE 18: SSAE 16, codified in former AT section 801,

What should we track if we manage third-party risk manually?

Keep a shared register that lets a colleague see why a service was accepted and what still needs attention. Include: Link supporting records rather than copying everything into the spreadsheet.

How should we compare SOC 2 audit proposals beyond price?

Compare the same scope, report type, period, and delivery assumptions first. Then ask about the engagement team's experience with your service, partner involvement, evidence requests, communication cadence, and how scope

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide