It relies on checking controls against connected systems on a schedule, collecting dated evidence as controls run and raising work when a control drifts. It matters most for reports and certificates that test operation over time.
The article on continuous evidence collection covers how it works.
Read more
Related terms
- Audit evidence
- Audit evidence is the record that a control operated as described, such as an approved change ticket, an access review record or a restore test result.
- Control
- A control is a measure an organization puts in place to manage a risk or meet a requirement, such as an access review, an approval step or encryption.
- SOC 2 Type 2
- A SOC 2 Type 2 report gives an auditor's opinion on whether controls were suitably designed and operated effectively throughout a review period.