Practical notes on audits and controls

SOC 2 Type I or Type II: which one first?

Both reports are issued by a CPA firm against the same Trust Services Criteria. The difference is what the auditor tests.

A Type I report confirms your controls are designed properly on a single date. It is faster to get, often within weeks of being ready.

A Type II report confirms your controls actually worked over an observation period, usually 3 to 12 months. It carries more weight because it shows evidence of control operation over time.

When Type I first makes sense

• A customer deal needs a report soon and will accept Type I for now.
• Your controls are new and you want an early check before the observation period starts.

When to go straight to Type II

• Your customers have said they need Type II.
• Your controls have been running long enough to produce evidence.

Whichever you choose, the readiness work is the same. Controls must be designed, documented and owned before either audit begins.

ISO 42001: what an AI management system asks of you

ISO/IEC 42001 was published in December 2023. It is the first certifiable standard for managing AI, and it follows the same structure as ISO 27001.

What the standard requires

• Scope and context. Which AI systems you develop, provide or use, and your role for each.
• AI risk assessment. How each system could cause harm or fail, and how you treat those risks.
• AI system impact assessment. The effect of each system on individuals, groups and society.
• Annex A controls. Reference controls covering policy, data, the AI system life cycle, third parties and responsible use.
• The management cycle. Internal audits, management reviews and continual improvement.

If you already hold ISO 27001

Much of the work is shared. Document control, internal audit, management review and supplier management can run as one program, with AI-specific risk and impact work added on top.

Start with an inventory of every AI system you build or use. Most organizations find more than they expected.

Five IT general control issues auditors find most often

IT general controls support SOX, SOC 1, SOC 2 and most IT audits. These issues come up again and again, and each can be fixed before an auditor finds it.

1. Late access removal. Accounts for people who have left stay active for days or weeks. Tie removal to your HR exit process and check it.
2. Access reviews without evidence. Reviews happen, but nobody can show what list was reviewed, who signed off or what changed as a result.
3. Incomplete user listings. The list used for a review comes from a report nobody has checked. Auditors will ask how you know it is complete and accurate.
4. Changes without approval or testing. Emergency fixes skip the process and are never approved after the fact. Developers with access to production make this worse.
5. Unmonitored privileged accounts. Shared admin accounts and service accounts sit outside the review cycle.

A readiness assessment tests these the way your auditor will, so you see the gaps first.