by Assurion Services | Oct 5, 2026 | Compliance Readiness
When an auditor tests your user access review, they are not checking that a review happened. They are checking three things: that someone looked at a complete list of who has access to what, that the person looking had the standing to say “this person should not...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
Auditors are not testing whether you have a change process. Everyone has one. They are testing whether anything reached production without going through it, and whether the changes that did go through it were authorised, tested and approved by someone other than the...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
Almost every company we work with has a vendor spreadsheet. Far fewer have a vendor management program, and the difference shows up quickly under testing. The spreadsheet lists the vendors someone remembered. The program can answer why that list is complete, why each...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
An auditor reading an incident log with zero entries for a twelve-month period does not think “well run”. They think “the definition of incident is too narrow, or nobody is writing things down”. A company that reports forty incidents,...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
Most companies preparing for an audit have a business continuity plan. Considerably fewer have evidence that they tested it, and almost none have evidence that the test found something. That last part is the one auditors weight most heavily: a business continuity...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
If you want to guess where your SOC 2 will produce an exception before anyone has tested anything, guess offboarding. Not because the control is hard to describe — “access is removed within one business day of termination” is one sentence — but because it...
