A 1 February 2026 Journal of Accountancy article on SOC credibility quoted CPAs worried that boilerplate reports can hide real control gaps, and the same worry applies to boilerplate policies. A CPA firm's checklist article, updated on 5 November 2025, makes a point first-time companies miss: the AICPA "has not issued a SOC 2 compliance checklist that contains the requirements," and other checklists are "just suggestions." That includes any list of policies you downloaded. What the criteria actually say is shorter and harder to fake.
What's affected
Every SOC 2 scope, because criterion CC5.3 asks that the entity "deploys control activities through policies that establish what is expected and in procedures that put policies into action." Policies say what is expected. Procedures say what people do. The auditor tests whether the second matches the first.
A policy becomes a testable control the moment you commit to it. If your access policy says offboarding happens on the last day, the auditor will compare termination dates with account deactivation dates.
What to do now
- Write one policy per area you actually operate: information security, access control, change management, incident response, vendor management, risk assessment, acceptable use, and backup and recovery if Availability is in scope. A policy for something you do not do is a liability.
- Put an owner, an approver, a version number and a review interval in each policy, and keep to the interval. CC5.3 includes the idea of reassessing policies periodically and refreshing them when necessary.
- Have every employee acknowledge the policies that apply to them and keep the signed records. One audit firm says its auditors "verify the presence of signed acknowledgment forms" for the information security policies issued to staff. Record the name, the policy and version, and the date.
- Check each policy sentence against reality. Delete any sentence you cannot evidence, such as a promised weekly review that nobody has run.
- Write procedures as short runbooks that a new hire could follow.
How to avoid this trap
- Do not adopt a template pack unedited. Policies that describe tools and steps you do not have will produce exceptions.
- Do not write a policy longer than the person who has to follow it will read.
- Do not let approval lapse. A policy with no approval date is a missing control.
Quick check
What does an auditor test about a policy?
Whether the procedures people follow match what the policy says, and whether staff have acknowledged it. A policy that is not followed produces an exception, however well written.
Sources
- Journal of Accountancy: Promises of fast and easy threaten SOC credibility (1 February 2026)
- Linford and Company: SOC 2 compliance checklist reality (5 November 2025)
- AICPA: 2017 Trust Services Criteria with revised points of focus (2022)
- KirkpatrickPrice: Why employees should sign a policy acknowledgment form
- A-LIGN: SOC 2 checklist
