CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
Control deficiencies are evaluated and reported promptly to those who must fix them, including senior management and the board where appropriate. Points of focus: management and the board assess the results of evaluations; deficiencies go to the parties responsible for correction and upward as appropriate; and management tracks whether they are remedied on time.
Source: SOC 2 (2017 Trust Services Criteria), CC4.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.
These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Deficiency or findings log with owner, severity, due date and status · SIEM / log platform
periodic reviewEvidence produced at each review
- Reports of open findings to senior management or the board · SIEM / log platform
- Evidence of closure and retesting of remediated deficiencies · SIEM / log platform
governing documentDocuments that govern the control
none for this control
First move
Common gaps auditors find
- Findings from audits or penetration tests left open past their due date
- No escalation of significant deficiencies to leadership
- Remediation closed without verification
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC4.1 Ongoing and separate evaluations of control (COSO principle 16) · CC5.1 Selecting control activities that mitigate risk (COSO principle 10)