When an assigned review keeps slipping
An access review has an owner and a due date. Each month, the owner postpones it because a customer issue takes priority. Management knows the reviews are late, but the subject disappears after a reminder email.
Eventually, the company discovers an account with permissions that should have been reduced after a role change. It needs to understand why the review was repeatedly delayed and why those delays never produced a management decision.
SOC 2 CC1.5 addresses that follow-through. In plain language, the organization holds people answerable for the internal control responsibilities that support its objectives. The AICPA Trust Services Criteria provide the authoritative wording.
Clear assignments give people a starting point. Accountability also requires a working process for reviewing performance, addressing obstacles, and responding when expectations are missed. Management's own decisions about priorities and resources are part of that process.
This is the fifth article in our SOC 2 Guide. The fictional examples show possible approaches for organizations with different resources and risks. Company size helps explain the examples; it does not prescribe a required management structure.
Set an expectation people can act on
An assignment such as "own access reviews" leaves important questions unanswered. Which systems are included? Who provides the account lists? What makes the review complete? What happens when a system owner does not respond?
Define the responsibility precisely enough that the person performing it and the person reviewing it understand the expected result. For an access review, that could include checking the account population, documenting decisions, tracking changes to permissions, and escalating unresolved access.
Agree on a schedule appropriate to the risk and name a backup. Give the owner the access, authority, and time needed to complete the work. If the owner can identify a problem but cannot obtain remediation, explain who can make the necessary decision.
Keep the arrangement somewhere managers use routinely. A control register, recurring task, or short responsibility statement may be sufficient. Avoid maintaining competing records that leave people unsure which deadline or owner is current.
Check that the person understands the assignment. Asking how they would handle a late response often reveals ambiguity that a policy acknowledgment misses.
Review the result and the conditions behind it
Management needs enough visibility to distinguish completed work from unresolved issues hidden behind a green status. Review selected completed records as well as the overdue list, focusing on activities where a poor decision could have serious consequences.
For example, an access review marked complete may still contain accounts awaiting a decision. Ask what the completion status means and where open decisions are tracked. If a reminder system closes tasks automatically, check whether the records show the actual outcome.
When work is repeatedly late or incomplete, investigate the cause before deciding on a response. Useful questions include:
- Did the person understand the task and have the skills to perform it?
- Were the required information and decision-makers available?
- Did management assign conflicting priorities or more work than the team could complete?
- Was the procedure workable, and did the owner raise the problem promptly?
Different causes call for different changes. Coaching may address a knowledge gap. Reassigning work may address an overloaded owner. A manager who repeatedly ignores escalations may need a change in expectations and oversight.
Record the action selected and follow it through. A new procedure or staffing decision only helps if someone checks whether performance improves. Where misconduct or personnel action may be involved, include the appropriate HR or legal adviser and restrict access to case details.
Examine the incentives around the work
The CC1.5 points of focus consider how responsibility is enforced, how performance is evaluated, and how measures, rewards, and pressures influence behavior. They help apply the criterion without prescribing the same scorecard, review frequency, or disciplinary response for every organization.
Consider a team rewarded for releasing features quickly. Security review is expected before each release, but delivery plans leave no time to review or correct the work. Employees learn which expectation receives management's attention when the two conflict.
The same problem can arise in other measures. A support team judged only on rapid ticket closure may close unresolved cases. A security team measured only on the number of vulnerabilities resolved may favor easy fixes while difficult, high-risk issues remain open.
Evaluate quality and consequences alongside completion counts. Recognize useful behavior such as raising a problem early, documenting an uncomfortable result accurately, or preventing a release that would expose customer information. Avoid targets that make concealment seem safer than asking for help.
Senior personnel should be subject to meaningful review as well. If a founder bypasses an approved process, establish who reviews the decision and what follow-up is required. An unexplained executive exception can weaken the expectations applied to everyone else.
Accountability with two founders and three employees
Consider a bootstrapped five-person software company. One founder manages engineering, and the other leads operations and customer relationships. The three employees also carry several responsibilities each.
The founders keep a shared schedule of important control activities. Each item identifies its owner, expected output, reviewer, and due date. They discuss outstanding work during an operational meeting, while handling sensitive personnel matters separately.
Suppose the engineering founder misses a scheduled access review while resolving a production issue. The operations founder checks what access may have gone unreviewed and helps assess the immediate exposure. They arrange temporary coverage and a new completion date while retaining the original missed date.
When the same conflict recurs, the founders change the allocation of work. An employee prepares the account lists, while the engineering founder makes decisions requiring technical judgment. The operations founder checks that outstanding permission changes are tracked and completed.
This arrangement depends on candid review between the founders and enough capability to assess the work. If neither can evaluate a significant issue, qualified external assistance may be appropriate. More complex services or consequential customer commitments may require stronger arrangements even at this size.
Evidence to keep: the responsibility schedule, dated review records, the missed activity and its cause, agreed changes, and subsequent completion records. Preserve actual management decisions rather than manufacturing examples of discipline.
How managers respond at 100 people
At a hypothetical 100-person organization, department managers own recurring controls relevant to their teams. A compliance coordinator tracks completion, while managers remain responsible for resolving staffing and priority conflicts.
The company could define escalation for overdue activities according to their risk. An overdue review of highly privileged accounts may need prompt attention. An administrative delay involving a lower-risk record may follow a different route. The response should reflect the exposure and the company's commitments.
Suppose several departments repeatedly submit incomplete vendor assessments. Management reviews examples and finds that the form does not explain who must assess the vendor's access to customer data. The company clarifies the process, trains the responsible managers, and checks the next assessments for the same problem.
Managers also discuss significant control responsibilities during performance reviews. They consider the employee's actions, available resources, and willingness to raise concerns rather than relying on a single completion score. Recurring review meetings supplement prompt attention to serious issues.
Evidence to keep: assigned responsibilities, overdue reports, escalation records, performance expectations, and completed corrective actions. Limit access to employee evaluations while retaining an appropriate way to support the examination.
Accountability across 1000 people
A hypothetical 1,000-person organization has regional teams, business-unit leaders, and central control owners. Accountability can become unclear when several groups participate in the same activity.
For a companywide access review, identify who owns the complete process and which local managers must make decisions. Document how unresolved disagreements reach someone with authority to act. Receiving a spreadsheet from every region does not establish that all required decisions or permission changes are complete.
Leadership could compare recurring exceptions by unit, examine shared dependencies, and check whether targets create conflicting incentives. If one unit consistently misses reviews because of an unfilled management role, the responsible executive should address the staffing decision and interim coverage.
Include relevant provider obligations in contract management. When an outsourced team misses a required task, the internal owner should assess the impact, pursue correction, and consider whether the service arrangement remains adequate. Keep the company's own decisions and follow-up visible even when another organization performs the work.
Evidence to keep: responsibility assignments, management reports, escalation decisions, provider follow-up, and verification that corrective actions worked. Summaries should remain traceable to underlying records without exposing unnecessary personnel details.
Keep a reliable record through the Type 2 period
A SOC 2 Type 2 examination addresses control design and operating effectiveness over a specified period. A current dashboard cannot establish that earlier work occurred on time if it overwrites historical statuses. The AICPA SOC 2 examination guide explains the examination framework.
Retain the relevant task population, expected and actual completion dates, review decisions, and changes in ownership. Link an overdue item to its corrective action so the explanation can be followed. If a deadline changes, preserve the original date and the decision behind the change.
When no exceptions occurred, keep the evidence of normal operation. If a problem did occur, record it accurately and retain the resulting decisions and follow-up. A review record created later does not, by itself, establish that the review happened earlier. Preserve supporting evidence from the time of the activity and distinguish the review date from the documentation date.
Discuss the necessary evidence with the examining CPA firm, including how to provide sensitive records securely. CC1.5 does not require one performance-review schedule, software product, or disciplinary measure for every company. The auditor determines the procedures needed for the examination; these examples do not guarantee its outcome.
Review one recurring delay
Choose a control activity that repeatedly misses its expected date. Ask the owner and reviewer to explain the cause, identify the management decision needed, and check the result after that decision is implemented.
The Control Environment articles connect ethical expectations, governance oversight, clear responsibilities, competent people, and accountability. The next article, CC2.1, examines the quality of the information people use to perform those responsibilities.
Support for your SOC 2 program
Genius GRC helps organizations develop practical controls and organize supporting evidence. Discuss your SOC 2 needs with us to identify where clearer expectations, workable responsibilities, or management follow-up would strengthen your SOC 2 program.
Explore the SOC 2 Guide for the full series.
This article provides general guidance. Adapt the examples to your examination scope and obligations with your advisers and auditor.