Consider deliberate misuse before it happens
Imagine your team is gathering evidence for a customer review. Someone notices that several access reviews required by your policy were completed late. A manager suggests changing the dates so the records look consistent with the process.
That’s an uncomfortable moment, and it’s worth thinking about before it happens. The manager has a reason to hide the delay and influence over someone who can change the evidence. Where could that combination arise in your business, and what would help your team respond?
AICPA criterion CC3.3 asks you to consider the potential for fraud when assessing risks to your objectives. For SOC 2, think about how deliberate misconduct could affect the service in scope, its information, or the reliability of its controls.
CC3.3 adds a deliberate-misconduct lens to the risk identification and analysis discussed in CC3.2. AICPA’s points of focus cover forms of fraud, incentives and pressure, opportunities, rationalization, and technology-related exposure. They guide judgment rather than prescribe a separate mandatory control for every point.
Make the discussion relevant to the service
It’s easy for a fraud discussion to settle on expense reports and false invoices. Include those where they’re relevant, then look at your customer information, privileged access, and security representations. Deliberate misuse in those areas can affect the service your customers depend on.
You might consider an employee exporting customer data for personal gain, a manager concealing a failed control, or a supplier misrepresenting who can access production. An undisclosed payment could also influence a purchasing decision and bring an unsuitable provider into your service. These are hypothetical scenarios to assess, not allegations about your employees or vendors.
Pick a process your team knows well. Who can initiate the action, approve it, change the supporting record, and review the result? Could someone with enough authority bypass that process? Could two people working together defeat the safeguard? Give the group room to discuss those possibilities without turning the conversation into an accusation.
Keep the assessment connected to the SOC 2 system and its objectives. Include service-specific scenarios even when a broader corporate fraud program already exists. Consider external actors as well as insiders, including how access to systems or information creates opportunities for deception.
Discuss pressure without profiling people
The COSO and ACFE fraud risk management guidance supports tailoring your approach to your circumstances. A useful way to begin is to walk through a process under a realistic business pressure and see where the safeguards might weaken.
Suppose a team’s bonus depends on releasing a product by a fixed date. Ask whether someone could conceal an unresolved security issue to protect that bonus. How could it happen, and who would see information that contradicts the release approval?
Keep the discussion on roles, access, decisions, and observable conditions. Personal characteristics and guesses about someone’s character won’t give you a sound assessment. Include the incentives and exceptions management controls, even when the person involved is a founder or executive.
Return to the dates in our opening example. Someone might argue that changing them only makes the evidence reflect what usually happens. Talk through that explanation with your team: preserve the actual dates, record the missed reviews honestly, and address the gap. Make sure people know they can raise it without being asked to tidy away the facts.
Examine the response as closely as the scenario
For each meaningful scenario, look closely at what the safeguard can do. A second approver needs access to the underlying information to provide a useful review. A log gives you limited protection if the same person can alter both the record and the log without detection. Keep those limitations in your assessment.
Describe the objective at risk, who could carry out or conceal the action, and the likely consequence. Then give someone responsibility for assessing the remaining exposure and deciding on treatment. “Fraud risk: low” won’t explain why you reached that conclusion.
Separate incompatible responsibilities where you can, and give reviewers reliable records they can access directly. If your staffing makes that difficult, consider a compensating review with enough information and authority to challenge the action. Explain how your chosen approach addresses the concern and where its limits remain.
Your employees also need a reporting route they can actually use, including when their manager is involved. Confirm who receives concerns and how you’ll protect sensitive information. Only promise anonymity when your process can support it.
If a concern comes in, preserve the relevant records and involve qualified HR, legal, or investigative support as appropriate. Evaluate the allegation carefully. Keep suspected incidents and sensitive case details out of broadly accessible risk records rather than presenting them as proven misconduct.
A bootstrapped five-person company with two founders
Picture a bootstrapped software company with two founders and three employees. If you’re one of those founders, you’re handling commercial decisions and administration alongside product work. You know everyone well, which can make deliberate misuse feel awkward to discuss.
Begin with the work rather than the people. Review sensitive customer exports, privileged account changes, and answers to customer security questionnaires. One founder can draft the assessment and the other challenge it, with employees explaining how the process works in practice.
Suppose you discover that either founder can export every customer’s records. You examine whether that broad standing access is necessary. One response could be to narrow routine permissions, record exceptional exports in a ticket, and have the other founder compare the justification with system records. If your tools don’t reliably record exports, keep that limitation visible in the assessment.
Your mutual review has limits because both founders retain authority. For a concern involving both of you, you could arrange a qualified external contact who agrees to receive and appropriately direct reports. Confirm that the arrangement works before telling employees to rely on it.
Keep the records that show what happened: the dated assessment, scenarios discussed, access decisions, actual reviews, assigned actions, and confirmed reporting arrangements. Simple records can work for a small team, but close relationships still deserve thoughtful safeguards.
You can record the customer-export scenario in Vanta’s risk register, assign its owner, and document the assessment and treatment plan. Use the entry to revisit access decisions and review practices together. Keep allegations and sensitive case details outside broadly accessible risk records, and keep challenging each other’s assumptions.
At 100 people, examine pressure across departments
Now imagine you’re working at a 100-person service provider with separate sales, engineering, finance, and security teams. A large sale is waiting on a customer’s security review. The commercial pressure is real, and several departments have a part in the answer.
Sales prepares the response, and technical owners check the material claims against supporting evidence. As you assess the process, consider requiring that review, retaining the sources, and correcting or clearly qualifying any answer the evidence doesn’t support.
Then ask the harder question: what happens if an executive tells the team to skip validation? An escalation route and a reviewer outside that executive’s immediate reporting line may help, provided the reviewer has the authority to act. Work through how the concern would reach that person.
Your security and HR teams can also look for repeated process overrides, with legal input where monitoring or personnel records require it. Treat an indicator as a reason for proportionate review, not an automatic accusation.
Evidence to keep: cross-functional assessment records, defined approval responsibilities, reviewed questionnaires, documented exceptions, and restricted records of concerns and follow-up. Keep sensitive case details separate from routine compliance reporting.
In Vanta, you could connect the misrepresentation risk to relevant controls and use its Action Tracker to follow the approved workflow improvement, owner, and due date. After the task closes, check actual responses to confirm technical review is happening. That gives your risk owner evidence about whether the improvement works.
At 1,000 people, resolve gaps between business units
At a fictional 1,000-person provider, you need to compare weaknesses across business units without losing the local details. A shared fraud assessment approach can help, with each unit explaining its systems, incentives, and scenarios.
Suppose several units use the same administrator service for customer environments. Each believes central security reviews privileged activity. Central security believes the units do it. When you bring the teams together, the gap becomes clear. You can assign responsibility and agree how the reviewer will use the actual service records.
Look at the business-unit targets too. Could they encourage someone to hide an incident or delay escalation? Give reviewers a route to raise concerns involving senior leaders, and bring significant matters to the appropriate governance body without circulating unnecessary personal details.
Evidence to keep: local assessments, consolidated findings, review responsibilities, investigation protocols, reporting to authorized leaders, and verified corrective actions. The depth of the program should reflect complexity and exposure rather than a fixed headcount threshold.
Vanta can help you connect recorded fraud scenarios with controls and supporting tests or documents, while treatment tasks identify the responsible teams. Use those records to support your review of coverage across business units. Management still needs to examine overrides and other behavior automated checks may miss; a passing status doesn’t establish the absence of fraud.
Keep an accurate record throughout the period
For a SOC 2 Type 2 examination, retain evidence showing how the relevant controls operated during the examination period. Preserve the original record when a review was late or an exception occurred. A later correction should show what changed and when; it cannot establish that an earlier review happened.
Record when you assessed the scenarios, who participated, what you concluded, and which actions followed. Revisit the assessment when responsibilities or incentives change materially. If you received no concerns, say that accurately. Don’t create sample incidents to make the process appear active.
If your reporting channel is quiet, ask whether people know how to use it and whether concerns receive attention. Check access to the case information as well. The absence of reports, on its own, doesn’t tell you that fraud risk is low.
Agree with the examining CPA firm on evidence needs and a suitable way to provide sensitive records.
The company sizes here illustrate different operating models, not required control designs. Sensitive information, concentrated authority, outsourcing, and demanding commitments can call for deeper review at any size. Choose safeguards and review frequencies for your actual exposure, and check which Vanta features your subscription and configuration support.
Start with a decision someone could conceal
Choose one sensitive action in your business and trace it from request through approval, performance, and review. Where could someone alter the evidence or influence the reviewer? Use what you find to improve the assessment and assign a practical response.
At Genius GRC, we help you assess fraud scenarios relevant to your service and build workable controls and supporting evidence. Talk with us about your SOC 2 needs. You can find the wider series in our SOC 2 Guide; the next article considers CC3.4 and significant changes affecting internal control.
This article provides general guidance. Evaluate the examples with your advisers and auditor in light of your examination scope and obligations.