One control, followed through a SOC 2 operating test.

1. The system description says team leads review production access every quarter. That one sentence tells the auditor what to expect: four reviews per in-scope system across a twelve-month window.
2. The firm's request list asks for every review performed in the window, together with the user listing each reviewer worked from.
3. Before opening the reviews, the auditor checks that those user listings were complete, for instance by comparing them with an export from the identity provider.
4. With so few occurrences, the auditor may inspect most or all of them. With many systems, the firm chooses a selection of system and quarter pairs.
5. Each chosen review is inspected: dated inside the right quarter, signed by the right person, and every removal it flagged actually carried out.
6. If one review cannot be found, the auditor looks into the cause and decides what that means for the criterion.

Populations usually come from you: a ticket-system query, an export of HR leavers, a report from the code host. The attestation standards treat material like this as information produced by the entity, and the service auditor must be satisfied it is reliable enough before leaning on it. In practice the firm asks how each list was made, may watch the query being run, and compares totals with a second source.

• Query kept. Save the filter or query behind each list so it can be run again in front of the auditor.
• Source named. Record which system produced the list and the date it was drawn.
• Totals reconciled. Tie the count to another record, such as new joiners against accounts created.
• Nothing removed. Hand over the whole list. Taking out awkward items, or offering a few favourite examples, defeats the test.

AICPA guidance leaves the size of a selection to the service auditor's professional judgement. Most firms keep an internal table keyed to how often a control operates and how much they plan to rely on it. Selections are commonly non-statistical, chosen to spread across the window rather than drawn by formula, so results are not projected with a stated confidence level.

A shorter window shrinks the lists, not the standard. In a six-month Type 2 a quarterly control occurs twice, so a single miss is half of everything there is to test. On longer windows, many firms test part of each list at an interim visit and select from the remaining months once the window closes.

A configured rule, such as a minimum password length or branch protection that blocks merges without approval, behaves the same way every time it fires. The auditor may inspect the setting and test it once, then rely on change management and restricted administrator access to show nobody altered it during the window. If those supporting controls have problems of their own, the shortcut disappears and the configured rule needs wider testing.

The standards ask the service auditor to look into the nature and cause of each deviation. What follows usually lands in one of three places.

Within what was planned for

The miss fits the rate the firm allowed for, and follow-up shows it was isolated. It is still described in the test results.

Testing widened

The firm selects more items, or examines a sub-group such as one team or region, to learn how far the problem reaches.

Control not effective

The misses show the control did not work well enough for its criterion. That can reach the opinion when no other control covers the same risk.

• A written root cause: what happened and why the control missed.
• Evidence of the fix and the date it took effect.
• Any other control that would have caught the same risk.
• A short management response, which the report can print beside the finding.

How findings shape the auditor's opinion is covered in our guide to opinions and exceptions.

Some controls only act on a trigger: an emergency change, a security incident, a new subservice organization. If the trigger never occurred, there is nothing to test for operating effectiveness. The auditor confirms the list is truly empty, for example by searching the change system for emergency tags, and the report records that no occurrences arose. The design of the control can still be assessed.

Sources: AICPA, AT-C section 205 (examination engagements), on the reliability of information produced by the entity and on investigating deviations; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization; AICPA Audit Guide, Audit Sampling (sampling risk and tolerable rate of deviation).