CC1.5 Accountability for internal control responsibilities (COSO principle 5)

People are held answerable for the internal control duties assigned to them. Points of focus: structures and authority are used to communicate duties and apply corrective action; performance measures, incentives and rewards reflect control responsibilities and expected conduct across short and longer terms; those incentives are reviewed for continued relevance; pressures created by targets are weighed when assigning work and measuring performance; and performance of control duties, including conduct and competence, is evaluated with reward or discipline as warranted. The 2022 revision adds, for privacy engagements, a defined sanctions process used when staff breach privacy policies or cause a privacy incident through negligence.

Source: SOC 2 (2017 Trust Services Criteria), CC1.5. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.