FAQ: What if no employee left or no incident occurred during the period?

Do not manufacture an event to fill an evidence request. Confirm that there really were no relevant occurrences and retain the records supporting that conclusion. For departures, that might involve reconciling HR records with the period under review. For incidents, distinguish no reported incidents from a missing incident log or ineffective reporting process. Explain how the control is designed to operate when needed and discuss the appropriate audit approach with the auditor. A tabletop exercise may help evaluate preparedness, but label it as an exercise rather than evidence that a real operational event occurred.

Related: SOC 2 audit and compliance hub.

Further reading: NIST control-assessment guidance.

Additional FAQs

What should we monitor after an AI feature goes live?

Monitor the outcomes that matter for the approved use, not just whether the service is online. Consider error reports, unexpected actions, review overrides, complaints, and meaningful changes in output quality.

What should we check before changing compliance platforms?

Export your evidence, control mapping, review history, issues, and ownership records before ending the old contract. Check whether the export includes attachments and timestamps, not just a summary spreadsheet. Plan

Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask: If names or reports cannot be shared, ask for alternative evidence and record

How often is a SOC 2 audit required?

The timing depends on customer and contractual requirements, not a universal certificate expiry date. Ask customers what report age and coverage period they accept, and check contractual requirements. Then agree

How should we organize SOC 2 evidence folders?

Choose a structure the whole team can explain, such as reporting period, control identifier, and activity date. Keep an index linking each requested item to its location and owner. Separate

Are Representation Letters Required in SSAE 18?

Yes. For SOC 1 examinations, the applicable AT-C requirements call for management’s written representations. This was not entirely new with SSAE 18: SSAE 16, codified in former AT section 801,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide