Effivity for SOC 2: how the software keeps a Type 2 evidence trail all year

What continuous evidence means for a Type 2 report

A Type 1 report tests the design of your controls at a single date. A Type 2 asks whether they operated effectively across a period agreed with the CPA firm, usually six to twelve months, and the firm answers by testing individual occurrences: an access review from the first quarter, a few changes from mid-period, a leaver from the final weeks.

Every occurrence therefore needs a record made at the time, showing when the control ran, who performed and approved it, what was examined and what was done about anything found. The firm also tests completeness: the list of occurrences you supply must match what your systems show. Screenshots gathered before fieldwork fail these tests. Set up for SOC 2, Effivity works the other way round: the control runs through a workflow, and completing the workflow leaves the record.

Mapping the criteria to controls, owners and frequencies

The control set is loaded into Effivity from the gap analysis and becomes the list the CPA firm will test. Each control carries what is done, written as your team really does it; the criteria it addresses; an owner, as a role with a deputy; its frequency or trigger; the evidence that proves each occurrence; and the system where the work happens.

State a frequency you can sustain: a control described as weekly is tested weekly, one skipped week becomes an exception, and "all" means all.

Confidentiality, processing integrity and privacy controls, where in scope, join the same set on the same terms.

How recurring controls leave dated evidence behind

Some controls run on a calendar; others run when something happens, such as a new starter, a leaver, a change or an incident. Calendar controls carry due dates, reminders and escalation; event controls are recorded as each event occurs. Either way, nobody collects evidence as a separate job.

• Access reviews. The system owner exports the user list, marks each account to keep or remove, attaches it and references the removal tickets. The approver's sign-off closes a record that shows the date, the list as it stood and the follow-through.
• Vulnerability scans. The scanner runs itself; the control is the review. The owner attaches the scan summary, triages findings by severity and sets the remediation dates your policy requires, and overdue actions escalate.
• Backups. Effivity holds the periodic restore test: what was restored, from which point and whether it worked. A backup nobody has restored is an assumption.
• Change approvals. Approvals stay in your ticketing or version-control tool. The Effivity control is the periodic reconciliation of what reached production against approved tickets, with anything that bypassed approval recorded.
• Vendor reviews. Each annual review records the assurance report obtained, the period it covered, its exceptions and the complementary user entity controls it lists for you.
• Training. HR holds each awareness completion with its date, so a sample of new starters is answered from one place.

The controls matrix and the CPA firm's sample requests

The firm sends a request list keyed to your controls, asks for the population of each control's occurrences, selects samples and asks for the evidence behind each. Some firms test the early months before the period closes, so requests may come in two rounds.

Each request maps to one control in your matrix and its records in Effivity. For calendar controls, the population is the list of completed occurrences held there. For event-driven controls, the firm will want the population from the system that logs the events, such as the HR system for leavers or the ticketing tool for changes, so it can test completeness; the Effivity records then show the control ran for each sample. Sample sizes depend on how often a control runs and on the firm's methodology.

Requests answered the same day, with record, attachment and approval, keep fieldwork short.

Incidents, missed controls and exceptions

Incidents are logged in Information Security Incident Management from detection through containment, recovery and post-incident review, with corrective actions tracked to closure. The firm samples incidents from that register against your response procedure, and significant incidents in the period may need disclosing in the system description.

When a control is missed, record it as missed, raise a Non-Conformance record with the cause and corrective action, and run the control as soon as possible. Never create a record later and date it as if it were on time: auditors compare record dates with source-system dates, and one altered record undermines the rest. If the firm reports a deviation, management may add a response in the report, built on that Non-Conformance record.

Readiness for the examination and the bridge period

Before the period opens, Sterling's readiness assessment tests the controls as the CPA firm will, sampling Effivity records against each evidence definition and raising shortfalls as Non-Conformance records with owners and dates. During the period, ISMS Dashboards can show management what is complete, late or open.

Customers soon ask about the months since the reported period ended. The answer is a bridge letter, a statement from your management, not the CPA firm, that the system and its controls have not changed materially. The next period normally opens as the last one closes, and the records Effivity keeps producing are what let management sign that letter accurately.

What Effivity does not do

• It does not issue the report. A licensed CPA firm performs the examination and signs the opinion.
• It does not decide. Scope, categories, accepted risks, whether an account keeps its access or a vendor stays approved: people decide, and the record shows who and when.
• It does not run technical controls. Multi-factor authentication, encryption, logging and scanning operate in your tools; Effivity records the review of their output.
• It does not make a control effective. A review signed off without reading the list still closes the task, and auditors notice reviews that never remove anyone.
• It does not write management's statements. The system description and assertion are management's; Sterling helps draft them from what the controls actually do.

Effivity for SOC 2: questions buyers ask