CC4 Monitoring Activities
Imagine you’re looking at your weekly backup report. Every job succeeded. Nothing needs your attention, so you move on. A few weeks later, your team runs a restoration exercise. The backup is there, but nobody running the exercise can retrieve the key needed to decrypt it. Recovery stops.
The reports gave you a reasonable answer to one question: did the backup jobs finish? You still needed to find out whether your team could recover the information. Finding that gap during an exercise gives you a chance to fix it before an actual recovery depends on it.
That is the kind of practical thinking behind AICPA criterion CC4.1. It addresses how you evaluate whether the components of internal control are present and functioning. You need a reasonable basis for believing your controls work, supported by evaluations that can uncover meaningful failures. Let’s look at how you can build that confidence without losing sight of the business you’re running.
Start with what you need to know
I’d start with one control and write down what you expect it to accomplish. Who owns it? Which systems and people does it cover? When should it operate, and what records should it leave behind? Those details give you a baseline for comparing the control you designed with what actually happens.
Take employee departures. You want to know whether access to the relevant company systems is removed within the time your company requires. You open a completed departure ticket, but it doesn’t mention the customer support tool. Or it shows an action as complete when someone has only scheduled it. You can’t yet conclude that access was removed as intended.
To find out, your reviewer could compare departure records with account histories in the systems involved. Keep a record of the period covered, the departures selected and the information supporting the conclusion. Check the full list of departures against an appropriate source, such as your HR records. Otherwise, you could do a careful review of an incomplete list.
Give the less visible parts of internal control some attention too. Alongside control activities, internal control includes your control environment, risk assessment, information and communication, and monitoring itself. Leadership oversight, risk decisions and annual activities may need evaluation even when your technical dashboard looks healthy. Automated checks alone can leave these areas uncovered.
Use everyday feedback and a closer look
You probably already have opportunities to evaluate controls in the course of ordinary work. A manager checks overdue departure tasks as they arise. Your security team reviews exceptions from a privileged-account check. When built into your business processes, these ongoing evaluations can give you timely information about whether controls are operating as intended.
Separate evaluations give you a chance to step back from that routine. Someone who didn’t perform the departure tasks could trace selected cases from the HR record through to actual access removal. That extra distance can help the reviewer question assumptions the team handling the work has stopped noticing.
AICPA’s revised points of focus recognize several evaluation methods, including management testing, internal audits, compliance and resilience assessments, security testing and third-party assessments. Choose methods that answer your questions with appropriate coverage and reliable evidence. A penetration test may tell you something useful about particular technical controls, while leaving other parts of internal control unevaluated. The points of focus guide your judgment; they don’t require you to perform every listed evaluation.
You can use ongoing evaluations, separate evaluations or a combination suited to your risks. A stable process you understand well may need a different approach from a newly acquired business or a service changing every week. Revisit your scope and frequency when something significant changes, problems recur or an important source of evidence becomes unreliable. CC4.1 doesn’t prescribe a universal schedule or sample size.
NIST’s continuous monitoring guidance offers a complementary way to maintain visibility into security controls and support risk decisions. You can draw on it without treating it as an additional SOC 2 requirement. Whatever approach you choose, make sure someone can interpret the exceptions and act on what they learn.
Check whether your monitoring process works too
Suppose your log-monitoring tool is generating alerts, but nobody is reviewing them consistently. The tool is working, yet an important part of your control process is failing. Security monitoring under CC7 can detect suspicious activity or system problems. CC4.1 asks you to look more broadly at the effectiveness of internal control.
In this example, you might check whether the right systems send logs, important alerts reach the responsible people and selected cases receive the attention your process requires. That gives you a better basis for judging the control than an alert count alone.
When you find a control deficiency, keep the next step clear. CC4.2 addresses evaluating and communicating deficiencies to the people responsible for corrective action, including senior management and the board as appropriate. Make sure your reporting shows unresolved findings clearly, even when the evaluation itself is complete.
Give your reviewers room to question the evidence
Your reviewers need to understand the business and its controls, get to the relevant records and have enough time to reach a supported conclusion. Separate evaluations should also be objective. Someone outside the immediate process may bring a useful perspective, but they still need enough expertise to recognize a meaningful failure.
Where practical, ask someone who didn’t perform the activity to evaluate it. On a small team, that might be another founder or an outside specialist. In a larger company, you might draw on a control assurance team or internal audit. Be honest about the limitations. A self-check can be useful, but it doesn’t offer the same challenge as an objective separate evaluation.
Give the monitoring mechanism a check of its own. An integration can stop sending data while your dashboard continues to show its last successful result. Look at timestamps, find out how missing input is reported and check that the evaluated population includes all relevant systems and accounts.
If you use a sample, retain the full population, your selection method, the cases examined and the results. Include unusual or higher-risk cases where appropriate. The awkward departure or unusual account may tell you more about a weakness than another straightforward ticket.
With five people keep your checks focused
Let’s return to that backup problem. Imagine you’re one of two founders at a bootstrapped software company with three employees. You run one hosted product and a small set of administrative tools. Your cofounder handles the technical side, including backups, while you manage operations and customer commitments.
You agree on a few important evaluation questions and who will review them. For recovery, you check whether scheduled restoration exercises took place and compare the results with the recovery commitments you’ve made. A teammate then works through the written restoration procedure, with specialist help if the exercise needs expertise your team doesn’t have.
Partway through, they discover that only your technical cofounder can retrieve a required key. The team can’t complete the restoration using the procedure as written. You arrange an appropriately protected alternative, update the instructions and repeat the exercise. This time, the restoration succeeds.
Keep both results. The failed exercise explains the weakness you found, and the successful retest shows what changed and when. You also need the procedure used, dated results, the reviewer’s conclusion and the corrective work. For this example, a short evaluation plan with linked records may be enough.
In Vanta, you can keep the relevant control records and supporting documents together. That makes them easier to find when you review the restoration results and recovery assumptions. You’ll still need to record your conclusion. Uploading the test report doesn’t, by itself, show that you evaluated it.
Keep the example in perspective. A five-person company operating a complex or high-risk service may need much more coverage and specialist support. Your risks and commitments should shape the work.
At 100 people look behind the completion status
Now suppose you’re responsible for the program at a 100-person service provider. You have engineering, support, HR and security teams, and your dashboard tracks access-review completion. Most reviews are finished on time. You want to know whether those completion indicators reflect meaningful reviews.
Your evaluator selects reviews and checks the account population, reviewer decisions and removal of unnecessary access. One review is marked complete, yet a service account has no identified owner. The evaluator records the exception and asks the responsible manager how that account escaped review.
Your team corrects the account and updates its instructions. Before you close the issue, a follow-up evaluation looks at other reviews that may have the same problem. You also consider whether workload or unclear ownership contributed to the omission. Otherwise, you could fix this account and find the same weakness in the next review.
Vanta can help you organize the evidence and follow-up work. It supports assigning tests and creating remediation tasks in integrated task trackers, so you can make ownership visible and track the correction. Keep the underlying records connected to that work, and support closure with evidence of the correction and a retest when warranted.
Your evaluation record should connect the scope, source population and selected cases to the findings and subsequent verification. When you report to management, keep the important exceptions visible alongside the overall completion figures.
At 1000 people check the gaps between teams
At a 1,000-person provider, you may have operational monitoring, a central control assurance team and internal audit all evaluating controls. With that much activity, it’s easy to assume somebody has covered every important process. A shared dependency can still fall between teams.
Imagine you bring the evaluation plans together and map them to your principal services and common processes. Each business unit reviews local administrator access. Then you reach the central platform that creates privileged accounts across all those units. Nobody has included that shared process in an evaluation.
You assign an evaluation owner with the right expertise. They examine the shared process and report findings to leaders who can arrange a companywide response. Local teams then confirm that the proposed corrections work in their systems. Keep responsibility for operating the control, evaluating it and resolving findings clear, while protecting the objectivity of separate evaluations.
In Vanta, your assurance lead can examine automated-test evidence to understand the logic, resources and exclusions behind supported tests. Historical results can help you examine performance over time. Check what each record actually covers. An export of the latest test run gives you different evidence from a history spanning the examination period.
Check that your combined evaluations cover the relevant controls, dependencies and risks. Successful automated tests won’t answer every governance or process question. Retain your coverage map, evaluation plans, relevant evaluator qualifications, completed work and follow-up to support your conclusions.
You may need this depth of analysis in a much smaller business with a complex shared platform. These company sizes help illustrate the choices; headcount doesn’t tell you how much assurance is enough.
Keep your evidence tied to the examination period
A SOC 2 Type 2 examination addresses control design and operating effectiveness over a specified period. Preserve the records used in each evaluation, the dates of the underlying activities and the date the reviewer reached a conclusion. You’ll want that history available later.
If a year-end review uncovers an earlier gap, describe it accurately and assess its implications. A new check performed after the examination period can’t demonstrate that a missed earlier check occurred. Keep the evidence of subsequent improvements, and discuss evaluation coverage and evidence needs with your examining CPA firm.
Let risk, the pace of change and what you already know about control performance guide your approach. Vanta’s features depend on your subscription and configuration. Competent review and management judgment remain essential.
Start with one result you already rely on
Take one indicator you use to judge a control and trace it to the underlying activity. Would your evaluation have found the missing key in our backup example? If you aren’t sure it could detect a meaningful failure, improve that evaluation before adding another dashboard measure.
At Genius GRC, we help you develop practical control evaluations and supporting evidence. Discuss your SOC 2 needs with us to shape a plan around your service and resources. You can also explore our SOC 2 Guide for related topics.
This article provides general guidance. The company scenarios are illustrative, not mandatory control designs. Adapt them with your advisers and auditor to your examination scope, risks and obligations.