After the first report
Catching SOC 2 control drift before the next sample does.
A SOC 2 report describes a window that has already closed. Buyers still read it as a statement about today, so the months after fieldwork count as much as the months before it. Monitoring is how you notice a control going quiet while there is still time to restart it.
Back to SOC 2 services01 · Monitoring is in scope
Watching your own controls is itself a criterion
CC4 expects evaluations, and expects findings to reach people who can act.
Monitoring is more than good hygiene. The Security category, which every SOC 2 includes, contains CC4, the monitoring activities criteria. CC4.1 looks for ongoing or separate evaluations that show whether the parts of internal control are present and working. CC4.2 looks for deficiencies to be judged and passed, in good time, to whoever must fix them, including senior management and the board where that fits. Your monitoring therefore leaves its own trail of records, and the auditor can sample that trail like any other control.
- Ongoing evaluation
- A check built into daily work, such as an alert when someone creates an account without multi-factor sign-in.
- Separate evaluation
- A periodic look from outside the routine, such as an internal review of one quarter's change tickets, or a penetration test.
- Deficiency log
- The record of what evaluations found, who heard about it and what was done. It is often the main evidence for CC4.2.
02 · Cadence calendar
A calendar sorted by how often each control runs
Rare controls fail silently. Put them where someone will see them.
| Cadence | Illustrative controls | Drift sign to watch for | Who looks |
|---|---|---|---|
| On each event | Joiner and leaver access, approval before deploy | Leaver tickets closed days after the HR exit date; merges with no second approver | Engineering manager |
| Daily or continuous | Log collection, backup jobs, vulnerability scans | A log source that stopped sending; a failed backup nobody reopened | On-call engineer |
| Monthly | Patch review, alert triage summary | The same text pasted into every month's record | Security lead |
| Quarterly | User access review, firewall rule review | Reviews dated in the final days of the quarter, or after it | Compliance owner |
| Annual | Risk assessment, policy review, recovery test, awareness training | No calendar entry for the month it falls due | Compliance owner with leadership |
Let the tools that do the work hold the proof: identity provider, code host, ticket system, HR platform. They record who acted and when without anyone typing it. Then open each one's retention settings. A short default can quietly delete the only record that a control ran, and a control with no surviving record looks exactly like one that was skipped.
03 · Drift signs
Early warnings that a control is going quiet
Most failures are missed dates, not broken technology.
- Records arrive in burstsSeveral months of evidence created in one week usually means a catch-up, and the timestamps give it away.
- An owner moves onA control with one named person behind it stops when that person changes role. Give each control a backup.
- A new tool slips inA team adopts a database or SaaS service that never reaches the access review or the vendor register.
- The same miss twiceA finding that repeats across periods suggests the monitoring itself is weak, and readers notice that.
- Blind faith in automationA compliance platform gathers evidence and raises alerts, but it sees only systems connected to it and does not decide what belongs in a population.
04 · Next period
Where monitoring meets the next report
Unbroken coverage depends on what happens between examinations.
Good monitoring lets the next period begin without a scramble. Scheduling back-to-back periods, and what a second examination adds, are covered in our year-two guide. When a customer asks about the months after your last period ended, management may answer with a bridge letter, explained in its own guide. One rule binds both: management can state only what monitoring actually confirmed.
Before anyone signs a bridge letter
Read the deficiency log, change log and incident tracker for every month since the period closed. If monitoring found a failure, the letter must not suggest otherwise. The letter is management's word; the CPA firm does not stand behind it.
05 · Monthly routine
A short control check, once a month
A small fixed meeting beats a quarterly fire drill.
- Open the cadence calendar and mark each control due last month as done, late or missed, with a link to its record.
- For anything late or missed, add a line to the deficiency log: what happened, what it affected, and the fix.
- Compare the system inventory with what monitoring covers, and bring in new tools, accounts and vendors.
- Confirm that every evidence source still holds records back to the first day of the current period.
- Send leadership a short summary. That message is itself evidence that deficiencies were communicated under CC4.2.
Sources: AICPA, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022), criteria CC4.1 and CC4.2; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization; AICPA, DC section 200 (DC9, significant changes).
06 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
Questions about monitoring between reports
Does a compliance automation platform count as monitoring?
It covers part of it.
Automated checks are a useful ongoing evaluation. You still need people to decide populations, review what the tool cannot see, and record how each deficiency was handled.
Will the auditor test our monitoring in a Type 2?
Yes. CC4 sits inside the Security category.
Because Security is in every SOC 2, expect the firm to sample evidence that evaluations happened and that deficiencies reached the right people.
What should we do when monitoring finds a missed control?
Log it, fix it, keep the record.
Never back-fill evidence. Record the miss, perform the control as soon as possible and note the root cause. The auditor may still report a deviation, but a documented response reads far better than silence.
Can we relax monitoring between reports?
Only if you accept a gap.
With back-to-back periods there is no quiet season. Any month outside a period is one that no report covers, and buyers will ask about it.
Keep each period covered while it runs.
We help you build a control calendar and a monthly monitoring routine that leaves evidence each time a control runs.