What tools have been most helpful to gather evidence for a SOC 2 audit?

Regulatory Compliance
21.4k viewscircle icon1 Upvotecircle icon7 Comments
Sort by:
CIO in Services (non-Government)2 months ago

We have had good experience with https://tugboatlogic.com/blog/tag/soc-2-compliance-automation-software/ and moved other compliance workloads in at the same time

Chief Information Security Officer2 months ago

Risk Cognizance acts as a central hub, automating and organizing evidence collection to simplify and accelerate the entire SOC 2 audit process. www.riskcognizance.com

Partner in Software7 years ago

Assuming you have some work loads in AWS there are a number of good solutions. I have looked closely at Orkus (full disclosure that I recently was asked to become and advisor). StrongPoint is also one to consider for relevant business applications

CIO7 years ago

For our SOC2 audit we are not using a 3rd party tool for documentation collection. We simply use Excel and a folder hierarchy.

Lightbulb on1
ex-CIO7 years ago

The right person with knowledge and skills in dealing with audits and auditors is more important than which tools to use. The bonus is that the 'right person' will probably know which tools are best suited to what audit.  My opinion only...

Lightbulb on2

Content you might like

Which pitfalls—model bias, false positives/negatives, data quality, regulatory constraints—often impede AI-based security tools, and how can they be mitigated in a financial-services context?

Read More Comments

Have you read the White House’s "Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence"?

https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/

Yes, I’ve read the whole thing8%

Yes, but I haven’t finished reading it49%

I’ve skimmed it24%

No, but I’ve read news coverage about it14%

Haven’t had the chance yet3%

View Results

What is stopping your company from automating your accounts receivable process?

Unsure what technology is available16%

Unsure we could implement it31%

Resistance to change38%

It could negatively impact customers22%

People could lose jobs15%

Our AR process is too complicated20%

Cost17%

Nothing, we have already automated our accounts receivable14%

View Results

Regarding the NACHA (ACH) rule changes taking effect March 2026, how are other US Banks/FIs complying or planning to comply? Specifically for the Send/Receive transaction level fraud and credit monitoring (pre-money movement)? Are there preferred providers which enable all pieces or monitoring? If so, who?