For a control that runs often, such as onboarding or production changes, the auditor first asks for the complete population, checks it is complete, then tests a sample. Rarely run controls may be tested in full.
The SOC 2 evidence list sets out the populations auditors ask for.
Read more
Related terms
- Audit evidence
- Audit evidence is the record that a control operated as described, such as an approved change ticket, an access review record or a restore test result.
- Exception
- An exception is a deviation an auditor finds when testing a control, such as a skipped access review or a change deployed without the required approval.
- Review period
- The review period is the window of time a SOC 2 Type 2 covers, over which the auditor tests whether controls operated effectively.