The SOC 2 Type I Gap in a Payroll Migration
Halcyon Retail is migrating payroll and benefits administration for 8,400 employees to a SaaS provider, and go-live is six weeks away. The provider has supplied only a SOC 2 Type I report covering the design of controls at a point in time; no Type II report exists because the platform launched eleven months ago. The provider uses a subcontractor in a second country to run the benefits calculation engine, disclosed in an appendix but not covered by the report's scope. The draft contract has no right-to-audit clause, no subprocessor approval right, and a 30-day breach notification window, while Halcyon's own incident policy commits to notifying regulators within 72 hours. The business sponsor says payroll cannot slip a quarter and asks risk to "sign off on the residual."
1. Assess whether go-live should proceed on this assurance evidence.
Read the worked answer
Separate what is proven from what is assumed.
- A Type I report proves control design at a moment in time. It says nothing about whether those controls operated over a period, which is the question that matters for ongoing payroll processing.
- The subcontractor is out of scope, so the calculation engine - where salary and benefit data is actually processed - has no independent assurance at all.
- The 30-day breach notification is incompatible with a 72-hour regulatory commitment. That gap is not a risk appetite question; it is a control failure written into the contract.
Judgement: do not approve as-is. Approve conditionally, with the contract fixes as conditions precedent to go-live (notification reduced to 48 hours, subprocessor approval and flow-down obligations, right to audit or a recognized alternative such as an agreed-upon-procedures engagement). Bridge the Type II gap with a scoped penetration test and a written control questionnaire covering the operating period, reviewed by someone who did not negotiate the deal. Document the residual as accepted only by the business sponsor, with an expiry date tied to the first Type II report.
2. Rank the remediation asks and explain why none can simply be dropped.
Read the worked answer
Rank by whether the item closes a gap that no other control compensates for.
- Breach notification alignment (highest). The 72-hour regulatory clock starts at awareness, not at vendor disclosure. A 30-day clause makes Halcyon structurally incapable of complying, and no internal control fixes a contractual timeline. This is non-negotiable.
- Subprocessor scope and flow-down. Halcyon cannot assess a control environment it has no visibility into. Subprocessor approval rights and flow-down of security obligations convert an unknown into a managed third party.
- Operating-period evidence. Can be partially bridged by testing and inquiry; it is a confidence gap rather than a blind spot, so it is the one item that can carry a documented interim acceptance.
- Right to audit. Valuable but partly substitutable by an annual assurance report plus an agreed-upon-procedures engagement.
Dropping item 1 or 2 leaves a gap the organization cannot compensate for internally. Dropping 3 or 4 leaves a gap that a stated monitoring plan can cover for a defined period.
3. How should the residual risk be recorded if the sponsor proceeds anyway?
Read the worked answer
Record it as an explicit, time-bounded acceptance, not a footnote in the project plan.
- Risk statement: payroll and benefits data for 8,400 employees processed by a subprocessor with no independent assurance and a notification window incompatible with regulatory obligations.
- Owner: the business sponsor, named, with delegated authority at a level that matches the exposure. Risk cannot accept on the sponsor's behalf.
- Basis: Type I report, scoped penetration test result, control questionnaire responses, and the specific gaps not covered.
- Compensating monitoring: quarterly review of subprocessor attestations, a contractual milestone for Type II delivery, and a manual early-warning process (regulator and vendor monitoring) to shorten detection.
- Expiry and trigger: acceptance lapses on a fixed date or on any of - Type II delivered with exceptions, a vendor security incident, or a change of subprocessor.
Then report it in the risk register with the other third-party risks so concentration across payroll, HR, and finance vendors can be seen together rather than in isolation.