FAQ: Do changes to compliance scripts and automation rules need review?

Treat changes according to their risk and the role the automation plays. A script that prepares an audit population or a rule that disables accounts can materially affect records or operations. Keep a change history, an owner, appropriate approval, and test results that show the expected outcome. Preserve the version used for important runs so an unexpected result can be investigated later. Avoid making unrecorded changes during fieldwork just to produce a desired status. The review can be proportionate, but the team should be able to explain what changed, why, and how it was checked.

Related: SOC 2 audit and compliance hub.

Further reading: NIST automated control-assessment guidance; NIST control-assessment guidance.

Additional FAQs

Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask: If names or reports cannot be shared, ask for alternative evidence and record

What should an AI inventory include?

Start with the AI services people actually use, including features inside existing software. For each use case, record the owner, provider, purpose, users, data involved, connected systems, and whether the

When is SSAE-18 Effective?

SSAE-18 became effective for practitioners’ reports dated on or after May 1, 2017.

What should we ask before commissioning an AI audit?

Ask what decision the audit is supposed to support. Name the system, use case, version, users, and risks to be examined. Then clarify the criteria, evaluator's qualifications and independence, evidence,

Which SOC 2 tasks should we automate first?

Start with repetitive collection or reminders where the inputs and expected result are well understood. Examples include scheduling evidence requests, exporting an approved report, or flagging an overdue review. Document

Can employees put customer data into an AI tool?

Only after the organization has approved that use and confirmed the relevant data, contractual, security, and privacy requirements. Check the provider's applicable terms and settings, including retention, training use, access,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide