SOC 2 Access Evidence: From Approved Change to Recorded Completion

SOC 2 evidence begins with the control you operate

A SOC 2 examination evaluates controls relevant to the systems and commitments in your organization’s scope. There is no universal “SOC 2 access report” that proves every company operates access management effectively. Your evidence has to match the control your organization says it performs and the period your auditor is examining.

For access changes, the useful question is usually not whether a policy document exists. It is whether the organization can show that its process operated: a change was initiated by an authorized person, routed to someone responsible for the affected system, completed or cancelled, and retained for later review.

Separate authorization from fulfillment

Organizations authorize access in different ways. A manager may initiate a request, HR may apply a role template, or an established internal process may produce the approved change. Permission Report respects that upstream authority: the originator’s authority is the approval, and there is no second approval gate inside the product.

The next step is fulfillment. The request is routed to the designated permission or equipment manager—the person expected to make the change in the actual application, system, or inventory process. Completion requires that responder to record a written sign-off, which Permission Report stores as the attestation.

Keeping those facts distinct makes the evidence easier to understand. The request explains what the organization intended. The sign-off records who reported carrying it out and when.

What Permission Report retains

Pending requests remain visible rather than quietly becoming history, and work that passes its effective date is identified as overdue. Cancelled requests retain the responder and reason. If a manager adjusts requested scopes while fulfilling an addition, the original request remains available for comparison with the access recorded as applied.

• The affected staff member
• The permission or equipment involved
• The requested action and, where applicable, requested permission scopes
• The originator and request context
• The intended effective date and processing priority
• The completion or cancellation outcome
• The named responder and their written sign-off
• The recorded response time
• Whether an authorized administrator completed the work through an override path

What a single evidence trail can look like

That record gives a reviewer a direct line from the approved change to the person who reported completing it. It is more useful than a bare checkbox because it identifies the subject, action, responsible responder, timing, and the responder’s own description of the work.

The sign-off should be specific and truthful. “Done” provides far less context than a short statement naming the action performed. The system preserves what the responder records; it does not independently inspect the external application to prove that statement.

Turn individual records into reviewable evidence

Permission Report provides several views of the same operating history so a team can answer different review questions without rebuilding the story from email and spreadsheets.

• Staff Access Report: what permissions and equipment people currently hold
• Permission Holding Report: who currently holds a selected permission, including recorded scopes
• Staff Audit Report: completed change history for a selected person, with sign-offs
• Permission Audit Report: completed add and remove history for a selected permission
• Compliance Activity Log: completed and cancelled permission and equipment requests across the organization, filterable by date and exportable as CSV
• Printable request and report views for a review packet or point-in-time walkthrough

Operate the process consistently

The quality of the evidence depends on the quality of the underlying process. Before relying on the reports, make sure the operating responsibilities are clear.

• Maintain a permission and equipment catalog that reflects the systems and assets actually in use
• Assign a responsible manager for each permission and equipment type
• Use meaningful effective dates and review overdue work
• Require responders to describe the specific action they completed
• Investigate cancellations and scope changes instead of treating them as administrative noise
• Periodically compare recorded holdings with the source systems and physical inventory
• Confirm the reporting period, sample expectations, and required corroborating evidence with your auditor

Know what this evidence does—and does not—show

A Permission Report record shows that an approved change entered the workflow and that a named person recorded its resolution. It can help demonstrate that a defined access-change process operated and give reviewers a consistent history to sample.

It does not decide who should be authorized, directly provision or revoke every external account, or replace source-system logs when those logs are part of the evidence your auditor requests. The strongest evidence package may combine Permission Report’s workflow history with identity-provider events, application logs, HR records, tickets, or other material appropriate to your control.