In its audit failure guidance, updated on 2 April 2025, a CPA firm lists "no separation of duties" among the common causes of failed SOC audits: if only one person can build, test and deploy a change, a coding error can reach production unchecked. That is the situation criterion CC8.1 is written to prevent, and for a small team it is also the easiest control to evidence.
What's affected
Every company with a production system. CC8.1 reads: "The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives." The points of focus add tracking changes, testing before implementation, approval before implementation, and a process for emergency changes.
Under a Type 2 the auditor takes the population of production changes in the period and samples from it. A CPA firm notes that a Type 1 sample of one can become 25 in a Type 2.
What to do now
- Protect the main branch in every in-scope repository: require a pull request, at least one approving review from someone other than the author, and passing checks.
- Link each change to a ticket. The ticket is the authorization, the pull request is the design and test record, and the deploy log is the implementation.
- Define an emergency change path in writing: who may approve, and a rule that review happens after the fact within a set time.
- Cover infrastructure changes too. Cloud and configuration changes made through code in the same review flow produce the same evidence.
- Keep a way to list all production deploys in the period, so the population is complete and checkable.
How to avoid this trap
- Do not allow administrators to bypass branch protection without a record. Bypasses become exceptions.
- Do not accept "reviewed offline" as approval. The evidence must be in the system.
- Do not forget schema changes, feature flags and infrastructure edits made by hand.
Quick check
What does an auditor need to see for each sampled production change?
Authorization, evidence of testing, an approval from someone other than the author where that is the stated control, and a deploy record, all linked to the same change.
