A company needs a way to find out when its controls stop working. Reviews can be missed, system changes can weaken an approval process, and responsibilities can become unclear as people move between roles. SOC 2 CC4, Monitoring Activities, addresses how management evaluates its internal controls and responds when those evaluations reveal problems.
The group contains two criteria. Together, they connect the evaluation of controls with the communication and follow-through needed to address deficiencies. For customers and other report users, this helps explain how the company learns about weaknesses in its own internal control system.
Controls can drift gradually. A review that once covered every production application may cover only part of the environment after an acquisition. A procedure may still name an employee who has left. Without deliberate evaluation, management may continue relying on controls whose coverage or execution has changed.
CC4 creates a basis for identifying that drift and bringing it to the attention of people who can act. It also makes repeated problems easier to recognize. Several missed approvals may point to an impractical workflow, unclear ownership, or a wider breakdown that deserves management attention.
The monitoring in CC4 concerns the internal control system. CC7 addresses system operations, including detecting and responding to security events and other deviations. Operational alerts can inform a CC4 evaluation, but a dashboard of alerts alone gives a limited view of whether the broader internal control system is functioning.
The labels below are editorial summaries, not official AICPA criterion titles.
See the AICPA Trust Services Criteria for the complete criteria and related points of focus.
A customer reviewing a SOC 2 report may want to understand who challenges the company’s assumptions about its controls. The useful questions extend beyond whether a review was scheduled:
Representative evidence might include completed control assessments, review workpapers, management meeting records, and a deficiency register showing the issue, owner, significance, and disposition. Follow-up records can connect a finding to a revised process and an evaluation of whether the change addressed the problem.
Consider a review that finds departed employees still appearing in an access population. A useful record explains how the omission occurred, which accounts were affected, who corrected it, and how management checked the revised process. A closed ticket without that context may leave important questions unanswered.
These records support the examination; the customer’s report may summarize the relevant controls and testing rather than include every underlying document. The examples describe possible evidence, not a universal SOC 2 document list or prescribed review frequency.
A Type 1 report addresses the system description and the suitability of control design as of a specified date. A Type 2 report also addresses operating effectiveness over a specified period. That distinction matters when assessing whether monitoring activities actually operated over time.
Read CC4 alongside the report’s system boundary, applicable criteria, auditor’s opinion, and any relevant test results or exceptions. An evaluation covering one service does not establish that every product or business unit received the same review. The report also describes responsibilities allocated to service providers and customers where relevant.
In a five-person company with two founders and three employees, one founder might review a sample of the other founder’s completed control activities and keep a concise record of findings. An outside specialist could help evaluate technical areas the team cannot assess credibly itself. The practical concern is obtaining useful scrutiny despite overlapping responsibilities.
At roughly 100 employees, department owners might perform defined assessments while a security or compliance lead consolidates findings and escalates overdue corrections. Consistent records help management recognize problems that cross departmental boundaries.
At roughly 1,000 employees, a coordinated evaluation program may involve specialist reviewers, internal audit, business-unit reporting, and executive oversight of significant deficiencies. Management needs enough consistency to compare results while accounting for different services and risks.
These are illustrations, not headcount thresholds. A small company operating a high-risk service may need deeper independent evaluation than a much larger company with simpler operations. Risk, complexity, change, and contractual commitments should shape the approach.
The individual articles will examine these topics in greater detail, with practical controls and supporting evidence. Links will be added as the articles are published.
Discuss your SOC 2 objectives with Genius GRC and identify controls and supporting evidence that fit your control evaluations, responsibility for findings, and corrective action.
