by Assurion Services | Oct 5, 2026 | Compliance Readiness
Almost every company we work with has a vendor spreadsheet. Far fewer have a vendor management program, and the difference shows up quickly under testing. The spreadsheet lists the vendors someone remembered. The program can answer why that list is complete, why each...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
An auditor reading an incident log with zero entries for a twelve-month period does not think “well run”. They think “the definition of incident is too narrow, or nobody is writing things down”. A company that reports forty incidents,...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
Most companies preparing for an audit have a business continuity plan. Considerably fewer have evidence that they tested it, and almost none have evidence that the test found something. That last part is the one auditors weight most heavily: a business continuity...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
If you want to guess where your SOC 2 will produce an exception before anyone has tested anything, guess offboarding. Not because the control is hard to describe — “access is removed within one business day of termination” is one sentence — but because it...
by Assurion Services | Oct 5, 2026 | SOC 2
The majority of control failures we report are not security failures. Nobody was breached, nothing was exposed, and in many cases the organisation is doing something perfectly sensible. The exception exists because the policy said the review happens quarterly and it...
