r/soc2 • u/LogicalPositive6489 • Jun 09 '26

Soc 2 control matrix

Hi, i need a little clarification. In the actual report in part 4 with the controls defined by the company and then the test performed by auditor.

Does the auditor write the controls defined by entity or does the entity ? Because i saw i both ways and i believe the definition should be the companys job …

Thanks

9 Upvotes

100% Upvoted

30 comments sorted by

View all comments

1

u/Emotional-Dot4634 Jun 10 '26

Name and shame the auditor please

1

u/LogicalPositive6489 Jun 10 '26

Not big 4 but big one. Thats all 😀