CC3.4 Identifying and assessing significant changes (COSO principle 9)

Changes that could significantly affect the system of internal control are identified and assessed. Points of focus: changes in the regulatory, economic and physical environment; changes to the business model such as new lines, acquisitions, divestments, rapid growth, geographic reliance and new technology; changes in leadership and their attitudes to control; changes in the organisation's systems and technology environment; and changes in vendor and partner relationships. The 2022 revision adds that the process also tracks shifts in internal and external threats and in the weaknesses of system components, and how those shifts change the likelihood and size of risks.

Source: SOC 2 (2017 Trust Services Criteria), CC3.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.