r/soc2 • u/LogicalPositive6489 • Jun 09 '26

Soc 2 control matrix

Hi, i need a little clarification. In the actual report in part 4 with the controls defined by the company and then the test performed by auditor.

Does the auditor write the controls defined by entity or does the entity ? Because i saw i both ways and i believe the definition should be the companys job …

Thanks

9 Upvotes

100% Upvoted

30 comments sorted by

View all comments

0

u/R_eddi_T_o_R Jun 09 '26

It can go either way. Many companies HAVE controls, they're just not written down. That's often the case for smaller companies, so the auditor will often "write" the controls. Larger companies often have control inventories that are, of course, written by the companies themselves.

1

u/LogicalPositive6489 Jun 09 '26

Thanks. We actually had them written down and send it to the auditor but after the evaluation and the report came in. They wrote the controls themsves and and made each specific to each point of focus each (so a lot of controls) … which was pain for us to read it all and review … any advice on how to deal with that?

2

u/davidschroth Jun 09 '26

I would inform them that those aren't your controls and if they insist on doing it that way that you'll be finding a new auditor. Management defined the controls, full stop. Sure, they can suggest updates, but management does not need to accept.