FAQ: What if no employee left or no incident occurred during the period?

Do not manufacture an event to fill an evidence request. Confirm that there really were no relevant occurrences and retain the records supporting that conclusion. For departures, that might involve reconciling HR records with the period under review. For incidents, distinguish no reported incidents from a missing incident log or ineffective reporting process. Explain how the control is designed to operate when needed and discuss the appropriate audit approach with the auditor. A tabletop exercise may help evaluate preparedness, but label it as an exercise rather than evidence that a real operational event occurred.

Related: SOC 2 audit and compliance hub.

Further reading: NIST control-assessment guidance.

Additional FAQs

What records should we keep from AI model evaluations?

Keep the purpose of the evaluation, the system and version tested, the relevant configuration, the approved test set or its controlled reference, results, and the reviewer’s decision. Explain the intended

We have a small company, how do we segregate Board of Directors from Management, and then, also the Internal Audit function?

Map three roles: who runs controls, who oversees management, and who independently evaluates the results. Mark where the same person fills more than one role. For example, a suitably independent

How should AI-related mistakes fit into incident response?

Use the existing reporting route, but make sure it recognizes AI-specific problems such as unintended disclosure, unsupported customer-facing statements, or an agent taking an unauthorized action. Record the use case,

When is a SOC 2 advisor worth hiring?

Consider an advisor when the team cannot turn audit expectations into workable processes, when scope is unclear, or when a deadline needs experienced project coordination. Define the missing capability before

How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system,

What is SSAE 18 (formerly SSAE 16)?

SSAE No. 18, Attestation Standards: Clarification and Recodification, is an AICPA standard that clarified and recodified the attestation standards. It superseded SSAE No. 16 and other earlier standards, with specified

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide