Compliance automation software that finds your SOC 2 and ISO 27001 exceptions before the auditor does
Exceptions found before the auditor finds them, and one evidence set for both audits.
See one case, screen by screen ↓Software that keeps the evidence for a company's controls collected, checked and ready for its SOC 2 Type II and ISO 27001 audits, instead of assembling it in the weeks before fieldwork. Compliance Automation (SOC 2 & ISO 27001) adds seven agents that collect evidence from your systems, reject evidence with holes, re-perform the auditor's sample test and draft cited answers, while control owners attest and the Head of GRC signs and releases.
How to choose AI solutions for back-office and enterprise work →
Updated
A company with a SOC 2 Type II report and an ISO 27001 certificate runs two audits a year over one set of controls, and both ask the same question: did each control work, every time, for the whole period? Today the answer is assembled in the last weeks before fieldwork — screenshots, ticket exports and spreadsheets chased from control owners, populations pulled with a different query each time, and the same evidence uploaded twice, once per audit, under different file names.
The first person to sample the tickets is the auditor. An access request provisioned without the line manager's approval, a leaver who kept access for a week, a production change merged without a second reviewer — each is found at fieldwork, too late to remediate inside the period, and the management response is written in a hurry. User access reviews, leavers and change management are among the most common sources of exceptions in SOC reports.
Estimated split for one SOC 2 Type II and ISO 27001 cycle at a large company, by hand and with the solution.
Seven agents collect, challenge, test and draft; control owners attest and the Head of GRC signs and releases.
Kestrel & Vane Group's SOC 2 Type II period runs 1 Nov 2025 – 31 Oct 2026; Harrow & Pell LLP starts fieldwork on 9 Nov and Northgate Certification's ISO 27001 surveillance audit follows on 1–3 Dec. On Wednesday 14 October the agents have worked overnight. Here is how the Head of GRC and her team work with them — ask, check the evidence, decide, sign — screen by screen, in the working solution.
Leah's day opens on a simple page: 94 of 103 controls steady, 3 exceptions found before the auditor, 6 gaps in the audit period, 86% of evidence serving both audits. Beside it, Needs you lists three decisions, and below, each agent says what it did overnight: the collector brought in 214 new items from 13 of 14 systems, the Skeptic rejected an alert-review export, the Tester repeated the auditor's test on access provisioning.
“What the agents did overnight — each message cites its sources · decide inline, or ask back.”
Leah types the question the auditor will in effect ask. The Tester answers in plain words: not cleanly. The auditor's sample of 25 would very likely include a March request, and 2 of the 38 March requests lack approval. It cites the two access requests and the change that fixed the form, so she can open each one.
“Expect an exception with a management response, not a qualified opinion: the control has worked since 1 Apr.”
Each control is one row with its SOC 2 criterion and Annex A control side by side — CC6.2 and A.5.18 for access provisioning — and a heartbeat across November to October: a pulse for each piece of evidence, a flat tinted stretch where nothing covers the period, a red dot for a failed sample. The line on top reads 103 controls, 94 steady, 6 gaps, 3 exceptions, fieldwork in 26 days.
The Skeptic rejected the alert-review export for CC7.2 / A.8.16: it covers 1 Nov – 14 Jul and 4 Aug – 13 Oct, and 15 Jul – 3 Aug is missing because the SIEM connection's token expired. The daily review is a key control with a 2-day tolerance. The Remediation agent found that evidence started flowing again on 4 Aug but the missing days were never re-pulled, and the SIEM archive keeps 13 months, so one click re-pulls the 20 days.
The Skeptic never fixes evidence; a person overrides it only with a reason.
The Tester read the control's four attributes, pulled 412 access requests and had the Skeptic reconcile them to 412 identity-provider grants. It selected 25 with Harrow & Pell's table — a population over 250, no deviations expected — with the random seed 20261014 recorded, and checked each ticket. ACC-4471 has no approver; ACC-4502 was approved by a peer, not the line manager.
Every check cites its ticket passage.
On the first exception the Tester extended the test to the whole population. Month by month, only March has failures: 2 of its 38 requests. The request form changed on 2 Mar and was fixed on 1 Apr. The result waits for a person to accept it or challenge it.
“The Tester never decides severity. Accept the result to send it on, or challenge it.”
The Remediation agent found the cause: CHG-20931 moved requests to a new form on 2 Mar with approval optional, until CHG-21140 made it mandatory on 1 Apr. It opened REM-118 for Ken Alvarez, the Identity & Access lead, due 21 Oct, to confirm or remove both grants with the line managers, and drafted the exception note. For ISO 27001 it calls it a minor nonconformity candidate against A.5.18, already corrected.
The drafted management response says what happened, how many requests were affected, when the rule was made mandatory and that all 412 were re-checked. Leah picks EX-2 — exception confirmed, remediated, response attached — adds a note for the record and signs. The note shows as signed, and the sign-off is logged in the audit trail.
“I, Leah Brandt, sign this as Head of GRC. My signature, the reason and the time are recorded.”
Tom Whitfield at Harrow & Pell asked for the population of access requests, the query and how Kestrel & Vane knows it is complete. The Audit liaison drafted the answer: 412 requests resolved as Provisioned, reconciled to the 412 identity-provider grants that carry a request reference, the 31 rejected requests excluded because no access was granted — each fact cited. Leah approves and releases it, edits it, or holds it with a reason.
“Nothing reaches the auditor until you release it.”
The readiness report, written from 6,840 evidence items and the Tester's runs, says Harrow & Pell would most likely report 3 exceptions, each isolated, and that 2 of 3 management responses are now signed. Of 6 gaps, 5 can close before 9 Nov; the one at risk is the Q2 restore test. Nothing found suggests a qualified opinion. Every sentence links to its source, and the Audit liaison flags the two that need her eye before the report goes to the CISO.
The same audit period, seen by four of the people who carry it — what the weeks before fieldwork looked like, and what they look like now.
Seven agents collect, challenge, test and draft; control owners attest and the Head of GRC signs and releases.
Maps every control to SOC 2 criteria, ISO 27001 Annex A controls and NIS2 Article 21 measures, and proposes Statement of Applicability exclusions with reasons.
Pulls evidence from 14 systems on each control's cadence, hashes and time-stamps every item and stores the query that produced it; when a system fails, it says why and proposes the fix.
Challenges every piece of evidence: does it cover the whole period, is the population complete and reconciled to its source count, is it dated and unedited — and says exactly what is missing.
Re-performs the auditor's test before fieldwork: samples with the service auditor's table and a recorded seed, checks every attribute of every sampled item with a citation, and tests the whole population when a sample fails.
Finds the cause in change and ticket records, opens the fix with an owner, a due date and the SLA, drafts the management response and the ISO 27001 classification, and books the re-test.
Links policy clauses to the controls that carry them out, flags reviews that are due and proposes edits as a before-and-after when the wording no longer matches practice.
Drafts each answer to the auditor's requests from the evidence, with a citation for every fact, and says what is not yet available and when it will be.
Owners attest; the Head of GRC signs and releases. The agents propose; a named person decides.
Ask about any control, piece of evidence or auditor request — or tell the agents what to do. Every answer cites its sources.
Would CC6.2 pass if the auditor tested it today?
Not cleanly. The auditor's sample of 25 would very likely include a March request; 2 of the 38 March requests lack approval. Expect an exception with a management response, not a qualified opinion: the control has worked since 1 Apr, and all 412 requests are now tested.
Which controls have a gap in the audit period?
Six: CC7.2 / A.8.16 alert review, 20 days; A1.2 / A.8.13 the Q2 restore test; CC1.4 / A.6.3 training, 37 people; CC9.2 / A.5.22 two suppliers; CC6.1 / A.5.9 the September reconciliation; CC7.1 / A.8.8 an undated report. Five can close before fieldwork.
How much of this evidence can the ISO auditor reuse?
5,912 of 6,840 items (86%) are cited by tests in both audits, through 94 controls that carry a SOC 2 criterion and an Annex A control. ISO also needs the management-system records (clauses 4–10), which sit in 11 ISMS controls.
Remind every owner who hasn't attested for Q3
Done. Reminders went to 5 owners for 22 controls due 20 Oct: Ken Alvarez (8), Marta Kowalczyk (6), Victor Chen (4), Grace Mensah (2) and Hannah Moore (2). Each reminder lists what the agents saw on each control, so they can attest in one step. It is in the audit trail.
13 screens from the working solution, on its sample data. Pick one to see it large.
The sample sizes, tolerances and rules the agents follow are settings. Only the Head of GRC changes them, and every change is in the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Sample size, event-driven population over 250 | 25 | Any size, from the service auditor's sampling table |
| Sample size, daily and monthly controls | 20 daily · 2 monthly | Any size, from the service auditor's sampling table |
| Coverage tolerance, daily key control | 2 days | In days; weekly controls in weeks (1 week) |
| When any sample fails, test the whole population | On | On · Off |
| Use the service auditor's sampling table when it has been shared | On | On · Off |
| A gap longer than 7 days on a key control becomes an exception candidate | On | On · Off |
| Remediation SLA | 7 days for a key control, 30 days for others | In days, for key controls and for other controls |
| Reason codes for signing an exception note | EX-1 · EX-2 · EX-3 | EX-1 Exception confirmed, remediation in progress · EX-2 Exception confirmed, remediated, response attached · EX-3 Not an exception (evidence attached) |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (CBIZ 2024 SOC Benchmark Study — user access reviews 15.6%, terminations 12% and change management 11.7% of exceptions; Bright Defense, SOC 2 audit costs 2026 — Type II fees about $30,000–120,000+ a year). AICPA Trust Services Criteria 2017 (rev. 2022), ISO/IEC 27001:2022 and NIS2 are named as context. People, companies and auditors named on this page are fictional — characters and sample data in the working solution.
Software that keeps the evidence for a company's controls collected, checked and ready for its SOC 2 Type II and ISO 27001 audits, instead of assembling it in the weeks before fieldwork. Compliance Automation (SOC 2 & ISO 27001) adds seven agents that collect evidence from your systems, reject evidence with holes, re-perform the auditor's sample test and draft cited answers, while control owners attest and the Head of GRC signs and releases.
The Tester takes the population the Skeptic has reconciled to its source, selects a sample with the service auditor's sampling table and records the random seed, then checks every attribute of every item with a citation. In the demo it sampled 25 of 412 access requests, found 2 without manager approval and then tested all 412 to show they were the only two.
Yes. Each control carries both its SOC 2 criterion and its Annex A control, so evidence collected once can serve both audits. In the demo 94 of 103 controls serve both frameworks and 5,912 of 6,840 evidence items (86%) are reused; ISO also needs the management-system records for clauses 4–10.
The Skeptic rejects it and says exactly what is missing — in the demo, 20 days of alert reviews after a SIEM connection token expired. The Remediation agent finds the cause and proposes the fix, and a gap longer than 7 days on a key control becomes an exception candidate.
Yes. The Scope mapper maps each control to SOC 2 criteria, ISO 27001 Annex A controls and NIS2 Article 21 measures, and proposes Statement of Applicability exclusions with reasons for the Head of GRC to approve.
Yes. The agents collect, check, test, draft and propose; they can never sign, release or approve. Control owners attest, the Head of GRC signs every exception note with a reason code and releases every answer to the auditor, and every action is on the audit trail.
Yes. Sample sizes by population, coverage tolerances, the full-population rule, the evidence rules, reason codes and remediation SLAs are settings. Only the Head of GRC changes them, and each change is recorded.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your control set, Statement of Applicability, policies and the systems your evidence comes from — and it goes live once every quality gate has passed. We will walk you through it on your own controls first.
Every EU entity scoped, registered and evidenced per country, with the board signing off.
1-min demoCyber Incident ReportingEvery regulator clock met, from one cited set of facts the committee signed.
1-min demoCMMC ComplianceEvery one of the 320 objectives proven before an executive signs the affirmation.
1-min demoWe'll run Compliance Automation on your own control set, a sample of your evidence and last year's auditor requests.