Once your SOC 2 report is issued, a quarterly check-in can help keep the work from slipping. Use it to find missed tasks, review changes and decide what needs attention before the next examination.
Quarterly is an example management rhythm, not a universal SOC 2 requirement. Keep each control on its own agreed schedule. Urgent issues and event-driven tasks must not wait for this meeting.
If you have just received your first report, start with the post-report handover guide. This article is the repeatable review that comes after that handover.
Bring the records you already use
The program owner can gather the task calendar and open action list before the meeting. Ask control owners to flag changes and problems. Bring links to the records rather than copying everything into another workbook.
- Work that was due since the last review.
- Unresolved findings and overdue actions.
- Important service or staffing changes.
- Incidents and recurring operational problems.
- The next reporting period and customer deadlines.
1. Check what actually got done
Look at all tasks that were due, including weekly and monthly work. This meeting is not just for controls labelled “quarterly.” A green dashboard or a closed reminder is not enough if the underlying work cannot be found.
For a weekly review, compare the expected weeks with dated completion records. Look at actual results from different parts of the quarter, not just the latest week. Ask the owner to explain gaps and show how issues were followed up. This is an internal spot-check, not the auditor’s sample or proof that every instance worked.
- Open the result for important completed reviews.
- Check whether the right person reviewed it.
- Follow up on late or missing work.
- Make sure the next due date matches the approved process.
For example, an access review may be marked complete while several removal requests remain open. Treat those requests as follow-up work. Do not assume the review solved the access problem.
This is management oversight, not a replacement for the auditor’s testing. Choose checks that fit your risks and investigate what they reveal.
2. Ask what changed
Ask each service owner one question: what is different from the service described in our report?
- Did we add a product or a new type of customer data?
- Did a provider take over work we used to do ourselves?
- Did a key owner leave or change roles?
- Did we replace a tool that holds evidence?
- Did we make a new customer commitment?
Give each relevant change an owner. Decide whether the control process or documentation needs updating. Raise possible scope or testing effects with the auditor early. A new tool should not silently break an old control.
3. Check that fixes worked
Review open findings alongside incidents and recurring support problems. Ask for the result of the correction, not just a statement that it is done.
Suppose a deployment skipped approval. The team added a release reminder. At this check-in, look at whether the revised process is working. If the same omission keeps happening, a reminder may not address the cause.
- What went wrong?
- What changed to prevent or detect it?
- Who checked the result?
- Is any risk still unresolved?
Escalate unresolved problems to someone who can make the decision. Do not wait for quarter-end to report a serious issue.
4. Check that evidence is still retrievable
Open a few recent records from the places owners say they are stored. Check that the date and result are clear. Confirm that the person coordinating the audit can retrieve them when needed.
A common trap is losing old tickets when moving to a new platform. Plan retention and access before the move. Keep records from before and after a process change. Do not backdate replacement evidence.
5. Look ahead
Check the next period’s due work. Include tasks that happen less often so they do not disappear between reviews. Confirm owners have time and a backup.
Check the expected report delivery date against customer needs. Keep the reporting period separate from the date the finished report will be available. Tell sales about scope changes before they reuse an old assurance statement.
Leave with a short action list
Record only what helps someone act:
- Issue or decision: What needs to happen?
- Owner: Who is responsible?
- Due date: When is it needed?
- Completion evidence: What will show it was resolved?
Keep a brief record of the review and its conclusions even when no new action is needed. Reuse the same action list next time. Do not create a separate tracker for every meeting.
The control-calendar FAQ explains how to align individual tasks with their actual frequency.
Source and scope: AICPA’s Trust Services Criteria address significant changes, monitoring and corrective action in CC3.4, CC4.1 and CC4.2. The agenda above is a practical example. It does not prescribe a quarterly frequency for every control or establish that all applicable criteria have been met.