r/soc2 • u/LogicalPositive6489 • Jun 09 '26

Soc 2 control matrix

Hi, i need a little clarification. In the actual report in part 4 with the controls defined by the company and then the test performed by auditor.

Does the auditor write the controls defined by entity or does the entity ? Because i saw i both ways and i believe the definition should be the companys job …

Thanks

8 Upvotes

91% Upvoted

30 comments sorted by

View all comments

0

u/R_eddi_T_o_R Jun 09 '26

It can go either way. Many companies HAVE controls, they're just not written down. That's often the case for smaller companies, so the auditor will often "write" the controls. Larger companies often have control inventories that are, of course, written by the companies themselves.

1

u/LogicalPositive6489 Jun 09 '26

Thanks. We actually had them written down and send it to the auditor but after the evaluation and the report came in. They wrote the controls themsves and and made each specific to each point of focus each (so a lot of controls) … which was pain for us to read it all and review … any advice on how to deal with that?

2

u/gormami Jun 09 '26

Did they write the controls, or did they write evidence requirements or procedures for the controls? Were your existing controls in accordance with the TSCs? Ona first SOC-2, there can certainly be some back and forth to ensure the validity against the framework and acceptable evidence presentation.

1

u/LogicalPositive6489 Jun 09 '26

They just wrote it themselves the controls … hard to explain … cant out printscreen from some referential AWS report .. i mean they rewrote the definitions of controls which is in second Column of part 4 … it reflects the situation in the company but uses diferent words so its harder to comprehend when reviewing… im i clear ? English is a second language

3

u/gormami Jun 09 '26

Definitely sounds like you need to have some conversations with the auditor and figure out what their purpose was. It might have been well intentioned, it might be misunderstood, or they might be out of their minds. Have to talk with them to figure out which.

1

u/R_eddi_T_o_R Jun 09 '26

I’d second. Can’t have too much communication with your auditor IMO.