Build an evidence trail
Start with relevant Trust Services Criteria, then link the policy, owner and operating evidence. Missing documentation creates a review task; it does not alone prove a control failed.
Use the mapped checklist
Fencia includes a SOC 2 governance map. A person links evidence and records decisions. The document scanner does not evaluate SOC 2 controls.
Leave the report to the auditor
A SOC 2 report comes from an independent examination. Fencia cannot issue that report or replace the service auditor’s testing.
Example: a buyer asks for access-control evidence
A prospective customer requests the latest SOC 2 report and asks how staff access to an AI service is controlled. If the company has no report, it should say so. The security owner can gather the access policy, approval records, periodic access review and incident procedure, then link relevant evidence to Fencia's SOC 2 map. That organized set helps prepare for a conversation with an auditor; it must not be presented as an issued SOC 2 report.
A practical evidence trail
- Name the control owner and the system within the proposed examination boundary.
- Keep an approved policy plus dated records showing that the control operated.
- Record exceptions, remediation and the reviewer's decision without overwriting earlier evidence.
- Confirm the criteria and examination period with the independent service auditor.
Common questions
- Can Fencia issue a SOC 2 Type I or Type II report?
- No. Only an appropriate independent examination produces that report. Fencia organizes internal records for review.
- Does a missing file mean the control failed?
- Not necessarily. It means the evidence in this workspace is incomplete. A reviewer must inspect the real control, its operation and any records held elsewhere.
Primary source: AICPA — SOC suite of services ↗
Bring the question into a review
Explore a fictional Fencia walkthrough or tell us which system and evidence your team needs to review.