SOC 2 governance: board oversight, control owners, the policy set and the evidence examiners test

What the criteria expect of oversight

Before a service auditor looks at a single access review or change ticket, it wants to know who is accountable for the controls and how that accountability is exercised. That question sits in the control environment series of the common criteria, CC1, which covers commitment to integrity and ethical values, oversight, structures and reporting lines, competence and accountability.

The common criteria follow the COSO internal control framework: a governing body sets expectations, management builds the structure, and people are held to account. Three neighbouring series depend on the same foundation. Communication and information (CC2) needs policies that are approved and communicated. Risk assessment (CC3) needs someone senior to accept the assessment and the treatments. Monitoring activities (CC4) need deficiencies reported to people with the authority to fix them. If governance is thin, all four series carry the weakness.

The criteria describe outcomes, not a committee structure, so you decide the design, write it down and follow it; the auditor tests against what you said you do.

Board or senior oversight: who it should be

In a company with a functioning board, the simplest design gives the board, or a committee of it, formal oversight of information security and the SOC 2 programme, with a short security report at each scheduled meeting.

Many service organisations seeking a first report are founder-led, with a board that meets rarely or consists of the founders themselves. The answer there is a senior governance or security steering committee: the chief executive or managing director, the person responsible for security, the heads of engineering and operations, and whoever runs people and HR. Reporting periodically to investors or non-executive directors, where they exist, adds some distance from day-to-day management. What matters is a written charter, a design that fits your size, and meetings that actually happen.

Control owners and a RACI that holds up

Every control in the control matrix needs one accountable owner: a person, by role, who answers for whether the control operated. Ownership fails in two familiar ways. Either the security lead owns everything, or ownership is given to a team name such as "Engineering", which leaves nobody to interview and nobody to chase when a review is late.

A responsibility table, kept beside the control matrix and approved by the governance committee, settles this. The example below is Sterling's recommended pattern for a small software company, not a requirement of the criteria; adapt the roles to your own structure.

Name a deputy for each accountable role. A control that stops for three weeks because its owner is on leave is still a control that did not operate in those weeks.

The policy set and its annual review cycle

Which policies you need, and how to write them, is covered in our guide to SOC 2 policies and evidence. The governance question is narrower: who approves them, when they are reviewed, and how people show they have read them.

A workable cycle has four parts. The security lead proposes changes at least annually and after any significant change or incident. The accountable executive or the governance committee approves the revised set, and the approval is recorded with a date and a version number. Staff and contractors in scope acknowledge the current policies on joining and again after each annual review. And the committee sees a short report of acknowledgement completion, with the stragglers named by team.

Fix the review month in advance and keep it clear of the fieldwork window. A review that slips by two months inside the period is exactly the lapse a service auditor records.

A quarterly governance meeting in one hour

Quarterly suits most service organisations: often enough for the minutes to show continuous oversight across the examination period, light enough that senior people attend. The criteria set no frequency, so write your choice into the terms of reference and keep to it.

Vendor oversight and the monitoring calendar each have their own guide in this series: vendor management and subservice organisations and continuous monitoring between examinations.

The governance evidence examiners test

In a Type 1, the service auditor confirms that the governance design exists and is in place at the report date. In a Type 2, it samples across the period. Expect requests for the following.

• Minutes of oversight meetings for the period, showing attendance, the security items discussed and the decisions taken, with actions followed through at the next meeting.
• The committee charter or board terms of reference that give it responsibility for security oversight.
• Policy approvals: dated, versioned records that the accountable person or body approved the current set.
• Policy and code of conduct acknowledgements for a sample of staff and contractors, including recent joiners.
• Risk assessment sign-off: evidence that management reviewed and accepted the assessment and its treatment plan within the period.
• The organisation chart and written role descriptions for security responsibilities, current at the time of testing.

Auditors also interview senior people about recent decisions; answers that match the minutes are the strongest evidence you have.

What weak governance looks like in a report

Governance weaknesses rarely stay contained. A missed quarterly meeting becomes an exception against the oversight control. Unsigned policy acknowledgements for new hires appear in both the control environment and the communication tests. An unapproved risk assessment weakens every treatment that depends on it.

Clients reading the report notice: several exceptions in oversight and policy controls suggest controls that run without anyone steering them. Our guide to SOC 2 exceptions and qualified opinions explains how exceptions are presented and when they affect the opinion; our guide to reading a SOC 2 report shows what clients look at first.

SOC 2 governance: questions buyers ask