SOC 2 continuous monitoring: keeping evidence flowing between examinations

Why a gap in the evidence becomes an exception

SOC 2 continuous monitoring means producing, checking and keeping the record of every control as it operates, month after month, so that the service auditor who samples the examination period finds each control where it should be.

The reason is in how a Type 2 examination works. A Type 1 report looks at design as at one date. A Type 2 report covers a period, and the CPA firm selects occurrences from across that period to test: a quarterly access review from the second quarter, a sample of changes deployed in different months, joiners and leavers from throughout the year. For each sample the question is simple: is there a record, dated at the time, showing the control ran as described? If the answer is no, the auditor cannot assume the control worked. The deviation is reported as an exception, and enough of them can lead to a qualified opinion.

Evidence cannot be recreated later. A review signed in December for a quarter that ended in June is evidence of a December signature, not of a June review, and service auditors look at system timestamps, ticket histories and document metadata precisely to tell the difference. The monitoring activities criteria (CC4) expect management to evaluate its own controls and act on deficiencies before fieldwork finds them. How exceptions are reported and what they do to the opinion is covered in the guide on SOC 2 exceptions and qualified opinions.

The control-frequency table: what runs when, and who proves it

The starting point is a single register of every control in scope with four facts against it: how often it runs, what record it leaves, who owns it and who checks that the record exists. The frequency is the one your own policy states, and that matters: the service auditor tests against the frequency written in your system description and policies, so a policy that promises weekly reviews turns every missed week into a deviation. The table is an illustration of common practice, not a requirement of the criteria.

Event-driven controls, such as changes and leavers, do not appear on a schedule, so the monthly check looks for them: every leaver that month needs a matching access removal.

Automated and manual evidence: what the service auditor still samples

Much SOC 2 evidence can come straight from the systems that run the controls, such as the identity provider, the code repository, the cloud console and the scanner. Such evidence is dated by the system and cheap to collect, so automate it wherever the platform allows.

Automation moves the audit focus rather than removing it. The service auditor will want to understand how each automated control was configured and whether that configuration stayed in place for the whole period. Where a tool produces an alert or a report, the control is not the report; it is the person who reads it and acts. A vulnerability scan that ran every week but whose findings nobody triaged is an operating failure with excellent evidence of itself.

Manual controls remain unavoidable: access reviews need a human judgement, risk assessments need a meeting, incident post-reviews need people to agree causes and actions. Define their record, signatory and storage in advance. The wider question of which policies and records you need at all belongs to the guide on SOC 2 policies and evidence.

The month-by-month rhythm between examinations

Once the period starts, the work settles into a repeating pattern. Because reports are renewed annually, the next period normally begins as the last one ends, so the rhythm never stops. The annual cycle and the bridge letter that covers the gap between reports are explained in SOC 2 bridge letters, report validity and the annual cycle.

Management's part in this cycle, from oversight of the control set to the review of deficiencies, is set out in the guide on SOC 2 governance; reviewing your subservice organisations' reports is covered in SOC 2 vendor management.

How Effivity keeps the evidence calendar

In a Sterling engagement the control register and the evidence calendar live in Effivity, the compliance platform used in 50+ countries, included with the engagement, at no additional cost. Each control carries its frequency, owner and deputy; each occurrence becomes a dated task with a place for the record; and the dashboard shows which controls are complete, due or overdue for the month. When a control owner changes role, the task follows the control, not the person. The full picture of the platform is in Effivity for SOC 2: the guide.

Mistakes that break the evidence trail

• Screenshots taken on the day of the request. A screenshot captured during fieldwork shows today's configuration, not the configuration in the month being sampled. Keep records dated at the time.
• Control owners who leave. When the person who ran the quarterly review leaves, the review often stops without anyone noticing. Name a deputy for every control and reassign ownership as part of the leaver process.
• Policies that promise more than the team does. A daily review written into policy but performed weekly produces a deviation every day. Align the written frequency with the practice before the period starts.
• Treating the gap between reports as a rest. The next period is already running; a quiet quarter after a report is a common source of the following year's exceptions.

The wider list of causes is in SOC 2 common mistakes: the ten that produce exceptions, and what to expect when the CPA firm arrives is in The SOC 2 examination.

SOC 2 continuous monitoring: questions buyers ask