Risk Management / Monitoring
Control gaps, exceptions, deficiencies, remediation owners, target dates, risk acceptances, and closure evidence are tracked through management oversight.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Control gaps, exceptions, deficiencies, accepted risks, and corrective actions remain visible from discovery through verified closure, with management attention focused on age and impact.
First SOC 2 program
Use one issue register fed by control reviews, incidents, risk work, and internal checks. Review it monthly, give every issue an owner and due date, and require concrete proof before marking corrective work complete.
As the company scales
Consolidate findings from control monitoring, automated tests, assurance work, incidents, vendor reviews, and exceptions into a governed workflow with severity rules, service-level targets, aging dashboards, escalation, and independent closure validation.
Identify which control reviews, alerts, incidents, risk assessments, vendor reviews, exceptions, and assurance activities can create a deficiency and who must enter it.
You should end up with: A documented intake process and accountable owner for each issue source.
Capture the affected control or objective, condition observed, dates, scope, evidence, impact, source, and related risks without combining unrelated problems.
You should end up with: Individual deficiency records with enough context for triage and later validation.
Apply severity and due-date criteria, choose remediation or risk acceptance, and assign an accountable owner, milestones, and target date.
You should end up with: An approved treatment decision and actionable remediation plan for each open item.
Review milestone status, overdue age, scope changes, blockers, and compensating measures on a recurring cadence, escalating based on impact and delay.
You should end up with: A dated monitoring dashboard and review record showing management follow-up.
Inspect the completed change and current operating evidence to confirm that the original condition and its relevant scope were addressed.
You should end up with: Closure support and reviewer approval linked to the original finding.
Analyze recurring findings, overdue patterns, repeat exceptions, and affected control families, then assign broader corrective action where symptoms share a cause.
You should end up with: Trend reporting and management decisions for systemic improvement.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Temporary departures identified through monitoring are visible, bounded, safeguarded, approved, and reviewed until correction or expiry.
Include this context
exception and control identifier
Include this context
scope and reason
Include this context
risk and safeguard
Include this context
owner and approver
Include this context
effective and expiration dates
Include this context
status
Weak evidence to avoid
An open exception that says remediation deferred with no affected scope, compensating safeguard, approver, expiration, or reassessment record.
Confirm what the record proves
Authorized management knowingly accepted a documented residual risk when remediation was deferred or declined, with time-bound review and stated rationale.
Include this context
risk and deficiency identifier
Include this context
residual risk and impact
Include this context
decision rationale
Include this context
accepting authority
Include this context
approval date
Include this context
expiration or review date
Weak evidence to avoid
A security analyst closes a high-impact finding as accepted without management authority, residual-risk detail, business rationale, or review date.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Management has a current view of control status, exceptions, deficiencies, overdue work, aging, severity, and affected services across the monitored population.
Include this context
control and issue identifier
Include this context
service or scope
Include this context
severity and age
Include this context
owner and target date
Include this context
current status
Include this context
last update and escalation state
Weak evidence to avoid
A dashboard showing 92 percent controls green with no underlying control IDs, open issues, aging, target dates, service impact, or data refresh date.
Confirm what the record proves
Observed control failures and gaps are recorded individually with their source, scope, facts, impact, severity, and accountable treatment owner.
Include this context
deficiency identifier
Include this context
source and date identified
Include this context
affected control and population
Include this context
condition and impact
Include this context
severity
Include this context
owner and disposition
Weak evidence to avoid
A row reading access review issue with no control, affected users, dates, source evidence, impact assessment, severity, or owner.
Confirm what the record proves
Corrective work has defined actions, owners, milestones, due dates, progress history, escalation, and validated closure tied to each deficiency.
Include this context
deficiency and action identifier
Include this context
remediation action
Include this context
owner
Include this context
milestones and target date
Include this context
status history
Include this context
closure evidence and validator
Weak evidence to avoid
A backlog item marked complete with no link to the original deficiency, implementation record, closure support, or independent validator.
Type 1
The current monitoring and severity method, live control-health dashboard, point-in-time deficiency and exception registers, and configured remediation workflow with any open plans as of the examination date. Include an applicable closure record through independent validation when one exists; if a complete query across every named finding source returns no closed occurrence, retain the zero-result query and walkthrough a representative deficiency from intake through remediation, validation, and closure.
Type 2
Every control monitoring result, deficiency, exception, remediation action, risk acceptance, escalation, and closure created or active during the review period from assurance work, incidents, vendor reviews, automated checks, and management review.
Reconcile findings and exceptions from each named source system to the central deficiency population, then reconcile dashboard totals to underlying records and require evidence-backed validation for every item closed during the period.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Control gaps, exceptions, deficiencies, accepted risks, and corrective actions remain visible from discovery through verified closure, with management attention focused on age and impact.
Compare the documented owner with the intended role (CISO / Security Compliance Owner), then compare dated records with the stated cadence: Ongoing; management review at least quarterly/annually.
Reconcile findings and exceptions from each named source system to the central deficiency population, then reconcile dashboard totals to underlying records and require evidence-backed validation for every item closed during the period.
The current monitoring and severity method, live control-health dashboard, point-in-time deficiency and exception registers, and configured remediation workflow with any open plans as of the examination date. Include an applicable closure record through independent validation when one exists; if a complete query across every named finding source returns no closed occurrence, retain the zero-result query and walkthrough a representative deficiency from intake through remediation, validation, and closure.
Every control monitoring result, deficiency, exception, remediation action, risk acceptance, escalation, and closure created or active during the review period from assurance work, incidents, vendor reviews, automated checks, and management review.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Temporary departures identified through monitoring are visible, bounded, safeguarded, approved, and reviewed until correction or expiry.
For each selected record, confirm it demonstrates Authorized management knowingly accepted a documented residual risk when remediation was deferred or declined, with time-bound review and stated rationale.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Management has a current view of control status, exceptions, deficiencies, overdue work, aging, severity, and affected services across the monitored population.
For each selected record, confirm it demonstrates Observed control failures and gaps are recorded individually with their source, scope, facts, impact, severity, and accountable treatment owner.
For each selected record, confirm it demonstrates Corrective work has defined actions, owners, milestones, due dates, progress history, escalation, and validated closure tied to each deficiency.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.