When an important change misses the people doing the work
An engineering team changes how emergency production access is approved. The new procedure is saved in the policy folder, and a manager announces it during a meeting. Two engineers are absent. A support employee who sometimes requests that access never receives the announcement.
The next urgent request follows the old process. Everyone involved believes they are doing the right thing.
This is a practical communication failure. The organization changed an expectation without reliably reaching the people whose actions determine whether it works. A well-written procedure has limited value when employees cannot find it or do not realize it applies to them.
SOC 2 CC2.2 addresses internal communication. In plain language, people need to understand the organization's control objectives, their own responsibilities, and the information they need to carry out those responsibilities. The AICPA Trust Services Criteria provide the authoritative wording.
The criterion's points of focus also consider communication between management and the board, reporting concerns when normal channels fail, security awareness, and timely updates about system changes. At the system level, authorized personnel need enough information about how the system operates and what it includes to understand their role. These considerations guide judgment; they are not a universal checklist of required controls.
This is the seventh article in our SOC 2 Guide. CC2.1 addressed information quality; CC2.2 considers how that information reaches people inside the organization. The company examples below are hypothetical. Adapt them to the services, risks, and people involved rather than treating headcount as a rule.
Decide who needs to know
Start with a particular process, such as production access, employee offboarding, or incident reporting. Identify the people who request work, approve it, perform it, and review the result. Include employees who provide occasional coverage and relevant contractors.
Ask what each person must understand to perform their part. A manager approving access may need the business justification and duration. An engineer granting it needs the approved permissions, expiration time, and recording requirements. Sending both people a long technical procedure may obscure the specific decision each owns.
For each important communication, establish:
- The audience and the action they need to take
- The person responsible for preparing and approving the information
- Where the current instructions can be found
- When the information must arrive and how questions will be resolved
Use existing tools when they work. A shared knowledge base, a team discussion, and a recorded acknowledgment can be sufficient for a straightforward change. Urgent operational instructions may require direct contact and confirmation that the responsible person is available.
Make the next action understandable
Tell people what changed, when it takes effect, and what they should do differently. Link to the current procedure and identify a contact who can answer questions. Retain the previous version where needed to understand earlier activity, while making the active version obvious.
Explain the purpose as well as the task. For example, a company may aim to limit emergency access to approved support work and remove it promptly afterward. A change to that objective needs to reach the people who approve and manage access. If a new hosting provider changes which systems they manage, explain the new boundary and the handoff to the provider.
In the access example, a useful announcement would explain that emergency requests now require a named approver, identify the backup approver, and show where to record the decision. It would also explain how to proceed when the normal approval channel is unavailable.
Check understanding through a short walkthrough. Ask an engineer to describe the next emergency request and ask a support employee how they would route it. Their answers may expose an unclear handoff before it becomes an incident.
Security awareness can use the same approach. Choose scenarios that reflect actual work, such as handling a customer file or identifying an unexpected authentication prompt. Record participation and follow up with people who missed the session. An annual course may be useful, but it cannot communicate every operational change that occurs during the year.
Give information a route back
Employees need a practical way to report confusing instructions, suspected incidents, and controls they cannot perform. Establish who receives these reports and how urgent issues reach someone able to act.
Tell employees how to report a suspected problem before they have all the facts. For example, an employee who sends a customer file to the wrong person should know which contact to use immediately and what details to provide. A reporting process that depends on finding an old training slide is easy to miss under pressure.
Consider situations in which the usual manager is unavailable or involved in the concern. An alternative contact should have accepted the role and understand the escalation process. Describe confidentiality accurately, especially in a small team where the facts may identify the reporter.
Management and the board or other appropriate governing body need information that allows each to perform its oversight role. Significant concerns should reach them with enough context for a decision. A concise report can identify the problem, affected service, immediate response, and unresolved question. Restrict sensitive supporting detail to those who need it.
Close the loop when an employee identifies a gap. Explain the resulting clarification or process change where appropriate. That response helps people understand whether reporting a problem leads to useful action.
A five-person company with two founders
Consider a bootstrapped software company with two founders and three staff members. One founder runs engineering, and the other manages customers and operations. With everyone working closely, the founders initially assume important information travels through everyday conversation.
They could create a short internal reference covering essential responsibilities, current procedures, and reporting contacts. Each founder owns the information for their area, while the other checks whether the instructions make sense to someone outside that specialty.
Before changing emergency access, the engineering founder walks all five people through a realistic request. The operations founder checks the coverage arrangement because customer support may receive the first call. Someone who cannot attend receives a separate briefing before they take responsibility under the revised procedure.
A dated note records the procedure version, participants, questions, and resulting clarifications. New staff receive the current reference during onboarding, along with an explanation of how to raise concerns with either founder. Concerns involving both founders need a credible alternative route appropriate to the company's circumstances.
If the founders use Vanta, they could keep the approved procedure and dated briefing notes as evidence linked to the relevant control. Assigning an owner helps keep responsibility for those records clear. The walkthrough remains important for checking whether everyone understands the change.
Evidence to keep: approved procedure versions, the audience list, dated briefings or acknowledgments, questions resolved, and records of actual escalations. The founders should retain their own participation records as well. This approach may suit a straightforward service. Sensitive data, complex systems, or significant customer commitments can require more formal communication and qualified support even in a five-person company.
A 100-person company with several departments
At 100 people, a change can reach engineering while missing sales, support, or a newly hired employee. A software company could assign a communication owner to each significant control change and use its employee and contractor records to identify the affected population.
Suppose the company replaces its approved file-sharing service. Security prepares instructions for handling customer files; IT explains migration and access; support updates its customer-facing workflow. Managers identify unusual cases, such as long-running customer exchanges that cannot move immediately.
The communication owner tracks who received the instructions, resolves exceptions with the relevant process owners, and records when the old method stops being authorized. A sample walkthrough with each affected department tests whether the revised process is usable.
New hires receive the current instructions rather than an outdated onboarding presentation. Managers who inherit control responsibilities get a role-specific briefing, even if they completed general awareness training recently.
The company could use Vanta to assign the updated policy to the right employee groups, track acceptance, and remind people with outstanding tasks. The communication owner would check that those groups match the affected audience, then use the walkthroughs to check understanding.
Evidence to keep: the change announcement, affected-person population, guidance versions, completion and follow-up records, approved exceptions, and results of departmental walkthroughs. Investigate missing recipients before treating a completion report as reliable.
A 1,000-person company across business units
A 1,000-person service provider may operate across time zones, languages, and acquired businesses. It could establish common communication responsibilities while allowing local delivery methods that suit each workforce.
For a revised incident escalation process, the central security team prepares the core instructions. Business-unit owners confirm local contacts, working hours, and translation needs. Each unit demonstrates that its on-call team can reach the designated responder and knows the backup route.
Leadership receives reporting on meaningful gaps, such as an acquired business still using a retired contact address. A companywide completion percentage should not hide that exposure. The responsible leader assigns corrective work and verifies that the local instructions and contact lists have changed.
Use communication exercises to test handoffs between units, particularly where an event begins in one service and affects another. Keep exercise results distinct from records of real incidents.
Vanta's continuous control monitoring could help the central team track policy acceptance and other supported control checks, with notifications routed to assigned owners. They could also attach local exercise results as evidence. Owners would review test coverage and exceptions; a passing result does not show that an on-call handoff works.
Evidence to keep: common and local instructions, distribution populations, training records, contact checks, exercise findings, and management follow-up. Preserve the effective dates of changes so earlier activity can be assessed against the instructions then in force.
Preserve the history during a Type 2 period
A SOC 2 Type 2 examination assesses the suitability of control design and operating effectiveness over a specified period.
Capture evidence when communication occurs. Retain enough context to identify the message, its audience, the date, and any required response. A screenshot of today's policy folder cannot establish which instructions an employee received several months earlier.
When training or acknowledgment is late, retain the actual completion date and document the response. Do not backdate records. If there were no relevant changes or reported concerns, record that accurately rather than inventing communications to fill an evidence folder.
Choose review and training frequencies based on risk, obligations, and workforce needs. None of the company sizes above establishes a universal schedule or requires a particular communication platform. Discuss the evidence approach with the examining CPA firm, especially where records contain sensitive personnel information.
Check one recent change
Select a procedure changed within the last few months. Ask three affected people how they learned about it and what they do differently now. Compare their answers with the current instructions, then correct any gaps in delivery or understanding.
Support for your SOC 2 program
Genius GRC helps organizations develop practical SOC 2 controls and organize supporting evidence. Schedule a free consultation to discuss communication responsibilities suited to your team.
Explore the SOC 2 Guide for the full series. The next article addresses CC2.3: External Communication.
This article provides general guidance. Evaluate the examples with your advisers and auditor in the context of your examination scope and obligations.