Reviewed October 30, 2026. Originally published in the SSAE 16 terminology series.
Controls at a service organization are the activities and mechanisms used to address relevant risks and objectives. Policies and procedures help describe how those activities are intended to work, but documentation alone does not show that a control operated.
What Does Operating Evidence Add?
Example Scenario: An access policy requires approval before a new employee receives permissions. The policy explains the intended process. The completed request, approval, and resulting access record help show what happened for a particular employee.
In a Type 2 examination, the auditor evaluates operating effectiveness over the specified period. A policy can support understanding of the design, while the records of actual performance support a different part of the assessment.
Management should keep the description consistent with the process staff perform. When responsibilities or systems change, update the approved documentation and retain the history needed to explain the period under examination.
For current report types and management guidance, see the AICPA SOC resources. Our SOC evidence guide explains the kinds of information that may be requested.
3 Responses
While P&P are not enough to figure out that a process is working successfully, they can assistance the design efficiency of a management. should be developed, applied, and recorded by the assistance company. When the assistance auditor is examining the potency of your management goals and actions, your P&P assistance the accomplishment of the management goals.
audits are so stressful, aren’t they? even if you know you’ve done everything right, it’s still not a good experience