SOC 1 (SSAE 18 / ISAE 3402)

Control objectives and controls: design, operation, deviations and change – SOC 1 (SSAE 18 / ISAE 3402)

SOC 1 (SSAE 18 / ISAE 3402) C.7: SOC 1 C.7 Changes to controls during the period managed so that superseded controls can be tested and the changes described

Changes to the system and its controls during a type 2 period are recorded so that the description can include them and the auditor can test superseded controls that were relevant to an objective before the change; where the auditor cannot, it determines the effect on the report.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Control objectives and controls: design, operation, deviations and change – SOC 1 (SSAE 18 / ISAE 3402)

C.1 SOC 1 C.1 Control objectives that are reasonable in the circumstances and relevant to user entities' financial reporting
C.2 SOC 1 C.2 Controls suitably designed: risks identified and the controls, if operating effectively, giving reasonable assurance the objectives are achieved
C.3 SOC 1 C.3 Controls implemented and, in a type 2 report, operating effectively throughout the period
C.4 SOC 1 C.4 Deviations investigated, explained and remediated, with fraud and noncompliance assessed for their effect
C.5 SOC 1 C.5 Information produced by the service organisation that the auditor relies on is accurate, complete and sufficiently precise
C.6 SOC 1 C.6 Internal audit reports and regulatory examination reports relating to the services made available

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SOC 1 (SSAE 18 / ISAE 3402) controls