To prove SOC 2 policy controls, keep for each policy an owner, an approval record, a review on the schedule you promised and an acknowledgement from every in scope employee, including people hired mid period. Auditors compare your own rules with dated records. One missed annual review or one unsigned new hire is an easy exception to find.
Which criteria touch policies?
CC5.3 says the entity deploys control activities through policies that establish what is expected and procedures that put them into action. The AICPA points of focus under it include establishing policies and procedures to support management's directives, assigning responsibility and accountability for executing them, performing in a timely manner, taking corrective action and periodically reassessing policies and procedures, refreshing them when necessary.
CC2.2 covers internal communication of information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. Policies and acknowledgements are the usual evidence that communication happened. The CC1 series, on the control environment, also expects standards of conduct to be communicated and adherence evaluated.
Because a Type 2 report covers a period and tests operating effectiveness, the auditor tests whether reviews and acknowledgements occurred as your policy says, throughout the period.
What evidence proves a policy review?
For each policy, keep a version history showing: the document, version number, date of review, reviewer name and role, a summary of changes (even "no changes required") and the approver. Approval should come from someone with the authority to bind the company, such as a founder or the head of security, and not from the author alone.
A policy register is the simplest tool: one row per policy with owner, last review date, next review date, approver and a link to the current version. Review reminders in a calendar and a ticket per review make the control repeatable.
If your policy says annual review, the next review date must fall within twelve months of the last. Aim for a margin. If something slips, record why and the date you completed it.
What evidence proves acknowledgements?
For each person in scope: name, role, hire date, which policies they acknowledged, version and date. Prefer a system that records a timestamp and the person's identity over a signed PDF scattered in email, because you need to produce a complete population quickly.
Decide in advance and write down:
- Which policies every employee acknowledges, and which only certain roles do.
- A deadline for new hires, such as within a set number of days of start, and a rule for contractors.
- What happens when a policy changes materially: re-acknowledgement or notice.
- How you handle the unacknowledged: reminders, escalation to a manager and a hard deadline.
Auditors usually ask for the list of employees active during the period, then sample people and check acknowledgements against hire dates. Your headcount list must match HR records.
What goes wrong most often?
- A policy review date that passed during the period because the owner left.
- Acknowledgements missing for contractors or part year employees.
- New policy version published without a record of who approved it.
- Policies that promise things you do not do, such as quarterly reviews of something you check annually.
- Acknowledgement system and HR roster out of sync.
- Reviewers rubber stamping with no change summary.
- Policy files stored in several places with different versions.
Who should own this?
A named policy owner for each document, a single programme owner who watches the register and HR for the roster and onboarding timing. Add a quarterly check by someone other than the programme owner.
What to do
- List every policy with owner, approver, review frequency and next review date.
- Remove promises you do not intend to keep and tighten the text to match practice.
- Put review tasks in a calendar with tickets and attach the evidence.
- Choose a tool that timestamps acknowledgements and exports a population.
- Set a deadline for new hire acknowledgements and add it to the onboarding checklist.
- Reconcile the acknowledgement list with the HR roster each quarter.
- After any material change, publish the new version with an approval record and a re acknowledgement plan.
- Keep prior versions available for the whole audit period.
Quick check
How often must a SOC 2 policy be reviewed?
The criteria call for periodic reassessment without fixing a frequency. Annual review is common, and the auditor tests against whatever frequency your own policy states.
Do contractors need to acknowledge policies?
If they have access to in scope systems or data, auditors commonly expect it. Define the rule in your policy and follow it consistently.
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022): CC5.3, CC2.2 and the Type 2 definition.
How Safeguard helps automate this
Policy evidence is a chasing problem: reminders, sign offs, rosters. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of screenshots, and monitoring runs between audits, which leaves the team more time for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability, so policies on vulnerability handling can be checked against what your systems actually show. The remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. Safeguard does not replace your auditor. Book a call.
Last reviewed: 18 October 2026.
