When an assigned review keeps slipping
You have an owner for the access review. You have a due date. You have even sent the reminder. Then a customer issue takes over, the review slips again, and everyone moves on until next month.
Now imagine finding an account that still has permissions its owner no longer needs. You need to fix the access, of course. You also need to understand why a known delay never led to a decision about coverage, priorities, or risk.
That is the practical work behind SOC 2 CC1.5: holding people accountable for the internal control responsibilities that support your objectives. The AICPA Trust Services Criteria provide the authoritative wording. Your own management decisions belong in this discussion too. People need time, authority, and usable information to do the work you assign.
This fifth article in our SOC 2 Guide works through that follow-through. The companies below are fictional. Use their situations to think about your own risks, rather than treating their headcounts as rules for your program.
Set an expectation people can act on
Before you chase another overdue task, sit down with its owner. Ask them to describe what completion looks like. If the assignment is simply “own access reviews,” you may discover that you have different answers.
For that review, agree on the systems covered, who supplies the account lists, who makes access decisions, and how permission changes are tracked through completion. Identify the person who can resolve an unresponsive system owner or a disputed decision. Name a backup and choose a schedule that fits the exposure.
Keep those expectations in the record your managers actually use: a control register, recurring task, or short responsibility statement. Give the owner the access, skills, and capacity to deliver. Then ask how they would handle a late response. That conversation often finds gaps that a policy acknowledgment leaves untouched.
Review the result and the conditions behind it
When you look at the overdue list, also open a few completed records. A green status may mean someone submitted the spreadsheet while several access decisions remain unresolved. Find out what the status represents and where the unfinished work goes. Check this especially carefully when a reminder system closes tasks automatically.
If work keeps slipping, resist jumping straight to an individual performance conclusion. Work through the cause with the owner:
- Was the task clear, and did they know how to perform it?
- Could they obtain the information and decisions they needed?
- Did you give them competing priorities or more work than they could finish?
- Was the procedure workable, and did they raise the obstacle promptly?
Then make a specific change. Coaching can help with a knowledge gap; redistributing work can help an overloaded owner. If a manager ignores escalations, address that manager’s responsibilities as well. Record the decision and come back to see whether it worked. For misconduct or personnel action, involve the appropriate HR or legal adviser and keep case details restricted.
Examine the incentives around the work
CC1.5’s points of focus ask you to consider performance, rewards, pressures, and how responsibilities are enforced. They leave room for judgment about the measures and review arrangements that fit your organization.
Picture your engineering team being rewarded for release speed while every delivery plan leaves security review until the final afternoon. Your policy may say review matters, but your planning teaches the team which priority wins. The same tension appears when support is measured only on ticket closure or security only on the number of vulnerabilities resolved.
Review quality and consequences alongside counts. Recognize the person who raises a difficult issue early or records an uncomfortable result accurately. Make room to hold a risky release. Apply meaningful review to senior people too, including a founder who bypasses an approved process. Unexplained executive exceptions make everyone else’s expectations harder to enforce.
Accountability with two founders and three employees
Imagine you are the operations founder in a bootstrapped five-person software company. Your cofounder leads engineering, and your three employees each cover several jobs. A shared schedule identifies the owner, reviewer, due date, and expected output for your important controls.
A production issue pushes your cofounder’s access review past its due date. At your next operational discussion, you look at the access left unreviewed and assess the immediate exposure together. You arrange temporary coverage and a new completion date, keeping the original missed date visible. Sensitive personnel matters stay out of the general meeting.
When the same conflict happens again, you change the workload. An employee prepares the account lists; your cofounder makes the technical decisions; you check that permission changes reach completion. In Vanta, you could assign the supporting document or test to its owner so the evidence work has a clear home. Your discussion still needs to settle who has time and authority to act.
Keep the evidence that tells the story: your responsibility schedule, dated reviews, the reason for the delay, the change you agreed, and the later results. Do not manufacture disciplinary examples. Candid review between founders also depends on competence; bring in qualified help when neither of you can assess a significant issue. A small team handling complex services or consequential commitments may need stronger arrangements.
How managers respond at 100 people
Now put yourself in a 100-person company. Department managers own their controls, and a compliance coordinator makes overdue work visible. Several teams keep submitting incomplete vendor assessments. Another reminder is unlikely to explain why.
You review examples with the managers and discover that nobody knows who must assess the vendor’s access to customer data. You clarify the procedure, brief the owners, and check the next assessments for the same gap. Vanta’s Documents page can help the coordinator find outstanding supporting records by owner or status. The managers remain responsible for the actual assessment and staffing decisions.
Escalate according to exposure. A missed privileged-access review may need faster attention than a lower-risk administrative delay. In performance conversations, consider the person’s actions, resources, and willingness to speak up alongside completion. Keep assigned responsibilities, escalations, corrective actions, and evidence of follow-through. Restrict employee evaluations and agree a suitable examination evidence approach.
Accountability across 1,000 people
At a fictional 1,000-person organization, your central access-review owner receives spreadsheets from every region. That looks reassuring until you ask who verifies the resulting permission changes. Each region thought the central team did it.
Name the owner of the complete process, identify the local decision-makers, and define where disagreements go. Your leadership reports should expose recurring exceptions and shared dependencies. If a vacant management role keeps a region behind, the executive responsible needs to decide on interim coverage and staffing.
Vanta’s owner assignments can help you distribute supporting test and document work across those teams. Keep your management review focused on unresolved decisions and whether corrective actions worked, rather than assuming assigned work is finished work. Check available features and access settings against your setup.
Apply the same follow-through to outsourced work. Your internal owner assesses missed provider obligations, pursues correction, and considers whether the arrangement remains adequate. Preserve responsibility records, management decisions, provider follow-up, and verification of results, with summaries traceable to restricted supporting records.
Keep a reliable record through the Type 2 period
A SOC 2 Type 2 examination addresses control design and operating effectiveness over a specified period. The AICPA SOC 2 examination guide explains that framework. Today’s dashboard may tell you little about earlier work if historical statuses have been overwritten.
Retain the relevant task population, expected and actual dates, review decisions, ownership changes, and corrective actions. When a deadline moves, keep its original date and the reason. When there are no exceptions, preserve normal operating evidence. When there is a problem, record it honestly.
A note written later does not establish that the review happened earlier. Keep evidence from the time and distinguish the activity date from the documentation date. Discuss retention and secure access to sensitive records with your examining CPA firm. Your review schedule and response should fit the risk; these examples do not guarantee an examination outcome.
Review one recurring delay
Start with one control that repeatedly misses its date. Ask its owner and reviewer what decision they need from management, make that decision, and check the result. You will learn more from resolving one real obstacle than from sending another broad reminder.
The Control Environment articles connect ethics, oversight, responsibilities, competence, and accountability. Next, CC2.1 looks at the quality of the information your people use to carry out those responsibilities.
Support for your SOC 2 program
If you want help turning unclear expectations into workable responsibilities and follow-through, discuss your SOC 2 needs with us. Genius GRC helps you develop practical controls and organize the evidence behind them.
Explore the SOC 2 Guide for the full series. This article provides general guidance; adapt it to your examination scope and obligations with your advisers and auditor.