Organizational structure, authority, and responsibility
A contractor finishes on Friday. You close the purchase order, their manager assumes IT will remove access, and IT waits for a departure request. On Monday, the contractor can still reach your customer support system.
You can probably picture the conversation that follows. Everyone understood their own piece, but nobody owned getting the whole job finished. SOC 2 CC1.3 helps you address that gap before it affects your customers.
In plain language, management establishes the structure, reporting relationships, and decision authority needed to achieve your objectives, with board oversight. The AICPA Trust Services Criteria provide the authoritative wording. For your SOC 2 program, those arrangements need to make responsibility for the in-scope system clear.
This is the third article in our SOC 2 Guide. The scenarios are fictional. Use them to think through your own services, risks, and complexity rather than choose controls by headcount.
Connect your reporting lines to the work
Your organization chart shows who reports to whom. When a control crosses departments, you also need to explain how those people work together. Start with access management, production changes, incident response, recovery, vendor oversight, and the other processes that protect your service and support your commitments.
For each process, identify an owner and who receives unresolved problems. Then ask whether that person has the information, resources, and authority to do the job. Someone checking offboarding needs to know which applications a person used and be able to obtain the relevant removal records.
The CC1.3 points of focus address organizational structures, reporting relationships, delegated authority, and responsibilities, including external parties. They help you apply the criterion. They do not prescribe a particular chart, job title, or matrix.
Assign the decision as well as the task
Walk through that contractor departure from the event that starts it to the evidence that access has ended. Make these responsibilities explicit:
- Your engagement owner records the end date and starts the departure process.
- An appropriate decision-maker handles unusual requirements or proposed exceptions.
- An authorized operator removes the relevant access.
- Your process owner checks completion across the systems in scope and escalates unresolved work.
In a small team, one person may hold several roles. Look carefully at concentrated authority and decide what review or other safeguard addresses the risk. Anyone checking a consequential decision needs enough knowledge and authority to challenge it.
A RACI matrix can help you distinguish responsible, accountable, consulted, and informed roles. A short written assignment can also work. Whichever format you use, keep the actual role holders current so a departure or reorganization does not leave you with a title and no person behind it.
Make authority and coverage clear
Tell your owners what they can decide, where they need approval, and who resolves competing priorities. A team lead might approve routine access within an established role, while a system owner approves broader privileges. For exceptions, name the authorized decision-maker, permitted duration, and review point.
Make the escalation route practical. If your provider cannot remove access by the required deadline, who can assess temporary restrictions and decide what happens next? The answer needs to work when the usual manager is away or involved in the issue.
Give critical responsibilities a backup and check that the person can use the approved instructions and systems. Preserve individual accountability and access controls. Sharing the absent owner’s password creates another problem rather than providing sound coverage.
Check what your providers actually do
When you outsource work, document the provider’s duties, your retained responsibilities, and the information you exchange. Check the agreement and service configuration rather than relying on a general statement that someone “manages IT.”
Your provider might disable the central identity account while a support application keeps its own local accounts. Assign that remaining step, who requests it, who handles a failure, and what evidence confirms completion. Keep an internal owner for consequential risk decisions and a route for resolving scope disagreements.
Applying CC1.3 at five people
Imagine you and your cofounder run a software company with three employees. You handle customers and operations; your cofounder leads product and engineering. You cannot create a separate department for every control, but you can agree on who owns the important decisions.
You keep contractor end dates and start departures. Your cofounder removes access and records the result. You compare that record with the application list and follow up on anything missing. A trained employee provides routine technical backup under defined authority.
You could reflect those assignments in Vanta’s control-owner records and organize supporting material with its document workflow. Keep the operational assignment clear too: the person collecting evidence may not be the person who performs or approves the task.
Before either founder takes leave, walk through the backup arrangements. If neither of you can evaluate a specialist issue, obtain qualified help while retaining responsibility for your company’s response.
Evidence to keep: your approved assignment list, current role holders, authority limits, backup instructions, and dated departure records showing who requested, performed, and checked the work.
Applying CC1.3 at 100 people
Now your departure process involves HR, IT, engineering, procurement, and application owners. HR starts employee departures, engagement owners start contractor departures, IT handles central accounts, and application owners cover systems outside that scope. You give the overall process an owner who can resolve gaps across both paths.
A new support tool gets missed during a departure. The process owner confirms who administers it, assigns the removal step, and checks whether other recent departures were affected. You update the workflow and keep the new application’s ongoing owner accountable for maintaining that coverage.
Vanta’s control ownership and evidence mapping can help you keep the supporting responsibilities visible across teams. Reconcile those records with your operational workflow and escalation route. A reassuring evidence status still needs to be checked against the actual work and systems covered.
Evidence to keep: your organization chart, department and application responsibilities, workflow assignments, escalations, completion records, and handovers when managers or control owners change.
Applying CC1.3 at 1,000 people
Imagine your company acquires a business that still uses its own identity platform. Your corporate chart does not tell you who removes local access or who can approve a temporary exception. You need to settle those questions while the systems remain separate.
A corporate process owner establishes common expectations. A named business-unit owner takes responsibility for local operation, receives incomplete departure work, and reports enough detail for the corporate owner to identify uncovered systems. Your integration plan includes an explicit handover of responsibilities.
Use relevant Vanta owner and document records to support that handover, keeping approved local differences visible in your responsibility records. Define where local authority ends, which conflicts reach senior management, and which decisions require governing-body attention. Check the features and permissions available in your Vanta setup before designing the supporting workflow.
Evidence to keep: corporate and local responsibility records, delegation limits, provider assignments, integration handovers, and escalated decisions with outcomes. Preserve enough detail to explain how your organization actually operated during the period.
Test your assignments against real work
Choose a completed workflow and ask the owner and backup to trace it. What triggered the work? Who made the decisions? Where was the result checked? Where would an unresolved step go? Compare their answers with the procedure and system records.
A clearly labeled exercise can help you explore an absence or unusual event. Record what you learn and assign corrections, but keep exercise results distinct from evidence of a real departure. Revisit assignments when people leave, services change, providers change scope, or teams reorganize. Set a periodic review cadence that fits your risks and retain event-driven updates too.
Remember that a five-person business handling highly sensitive information may need stronger arrangements than a larger business with a simpler service. Choose safeguards around the exposure you actually have.
Preserve the responsibility history
Keep approved records and enough history to explain changes during your examination period. An owner list created at period-end cannot show who performed a control months earlier. Dated workflow records, approvals, handovers, and escalations connect your arrangements to actual activity.
If your chart, policy, supplier agreement, and ticket queue name different owners, resolve the contradiction and communicate the correction. Capture scope, date, performer, result, and follow-up as work happens. Discuss evidence needs and access restrictions with your examining CPA firm. The auditor decides what testing and evidence are necessary; these examples do not guarantee an outcome.
Start with one important handoff
Pick a workflow that would cause real harm if it were missed. Bring the people involved together and agree who starts it, who decides, who acts, and who verifies completion. Then have your backup walk through the revised process. You will quickly see where an assignment still needs work.
CC1.2 addresses governance oversight. CC1.3 helps you organize authority and responsibility, while CC1.4 examines competence and CC1.5 addresses accountability.
Support for your SOC 2 program
At Genius GRC, we help you develop practical controls and organize supporting evidence. Discuss your SOC 2 needs with us to work through responsibilities and decision authority suited to your services, risks, and resources.
Explore the SOC 2 Guide for the full series.
This article provides general guidance. Adapt the examples to your examination scope and obligations with your advisers and auditor.