# Controls

URL: /systems/trust-and-governance/controls · Id: `page:systems/trust-and-governance/controls`

> Every control StartupBuilder runs, what it satisfies, and how its Evidence is tested.

Each control names the criteria it satisfies, the [Processes](/business/nouns/process) and [Systems](/business/nouns/system) that implement it, and its test.

| Control | Kind | Satisfies | Owner |
| --- | --- | --- | --- |
| [Conduct](/systems/trust-and-governance/controls/conduct) | preventive | [SOC2 CC1.1](/systems/trust-and-governance/criteria/soc2/cc1-1) | [Legal Lead](/agents/legal/legal-lead) |
| [Governance oversight](/systems/trust-and-governance/controls/governance-oversight) | detective | [SOC2 CC1.2](/systems/trust-and-governance/criteria/soc2/cc1-2) | [Founder](/agents/founding/founder) |
| [Role structure](/systems/trust-and-governance/controls/role-structure) | preventive | [SOC2 CC1.3](/systems/trust-and-governance/criteria/soc2/cc1-3), [SOC2 CC2.2](/systems/trust-and-governance/criteria/soc2/cc2-2), [ISO27001 A.5.2](/systems/trust-and-governance/criteria/iso27001/a-5-2) | [People Lead](/agents/people/people-lead) |
| [Worker competence](/systems/trust-and-governance/controls/worker-competence) | preventive | [SOC2 CC1.4](/systems/trust-and-governance/criteria/soc2/cc1-4), [ISO27001 A.6.1](/systems/trust-and-governance/criteria/iso27001/a-6-1), [ISO27001 A.6.3](/systems/trust-and-governance/criteria/iso27001/a-6-3), [HIPAA 164.308(a)(5)](/systems/trust-and-governance/criteria/hipaa/164-308-a-5) | [People Lead](/agents/people/people-lead) |
| [Action accountability](/systems/trust-and-governance/controls/action-accountability) | preventive | [SOC2 CC1.5](/systems/trust-and-governance/criteria/soc2/cc1-5) | [People Lead](/agents/people/people-lead) |
| [Risk assessment](/systems/trust-and-governance/controls/risk-assessment) | detective | [SOC2 CC3.1](/systems/trust-and-governance/criteria/soc2/cc3-1), [SOC2 CC3.2](/systems/trust-and-governance/criteria/soc2/cc3-2), [SOC2 CC9.1](/systems/trust-and-governance/criteria/soc2/cc9-1), [HIPAA 164.308(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-308-a-1) | [Founder](/agents/founding/founder) |
| [Fraud screening](/systems/trust-and-governance/controls/fraud-screening) | preventive | [SOC2 CC3.3](/systems/trust-and-governance/criteria/soc2/cc3-3) | [Risk Analyst](/agents/operations/risk-analyst) |
| [Control wake review](/systems/trust-and-governance/controls/control-wake-review) | preventive | [SOC2 CC3.4](/systems/trust-and-governance/criteria/soc2/cc3-4), [SOC2 CC5.1](/systems/trust-and-governance/criteria/soc2/cc5-1) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Control definition](/systems/trust-and-governance/controls/control-definition) | preventive | [SOC2 CC5.1](/systems/trust-and-governance/criteria/soc2/cc5-1), [SOC2 CC5.3](/systems/trust-and-governance/criteria/soc2/cc5-3) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Inherited floors](/systems/trust-and-governance/controls/inherited-floors) | preventive | [SOC2 CC5.1](/systems/trust-and-governance/criteria/soc2/cc5-1), [SOC2 CC5.2](/systems/trust-and-governance/criteria/soc2/cc5-2) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Policy approval](/systems/trust-and-governance/controls/policy-approval) | detective | [SOC2 CC5.3](/systems/trust-and-governance/criteria/soc2/cc5-3), [ISO27001 A.5.1](/systems/trust-and-governance/criteria/iso27001/a-5-1), [HIPAA 164.316](/systems/trust-and-governance/criteria/hipaa/164-316) | [Founder](/agents/founding/founder) |
| [One-way Action windows](/systems/trust-and-governance/controls/one-way-windows) | preventive | [SOC2 CC5.1](/systems/trust-and-governance/criteria/soc2/cc5-1), [SOC2 PI1.3](/systems/trust-and-governance/criteria/soc2/pi1-3) | [Finance Lead](/agents/finance/finance-lead) |
| [System description](/systems/trust-and-governance/controls/system-description) | detective | [SOC2 CC2.2](/systems/trust-and-governance/criteria/soc2/cc2-2), [SOC2 CC2.3](/systems/trust-and-governance/criteria/soc2/cc2-3) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Trust status](/systems/trust-and-governance/controls/trust-status) | detective | [SOC2 CC2.3](/systems/trust-and-governance/criteria/soc2/cc2-3) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Log completeness](/systems/trust-and-governance/controls/log-completeness) | detective | [SOC2 CC2.1](/systems/trust-and-governance/criteria/soc2/cc2-1), [SOC2 CC7.2](/systems/trust-and-governance/criteria/soc2/cc7-2), [ISO27001 A.8.15](/systems/trust-and-governance/criteria/iso27001/a-8-15), [ISO27001 A.5.28](/systems/trust-and-governance/criteria/iso27001/a-5-28), [HIPAA 164.312(b)](/systems/trust-and-governance/criteria/hipaa/164-312-b) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Continuous control testing](/systems/trust-and-governance/controls/continuous-testing) | detective | [SOC2 CC4.1](/systems/trust-and-governance/criteria/soc2/cc4-1), [ISO27001 A.5.36](/systems/trust-and-governance/criteria/iso27001/a-5-36), [HIPAA 164.308(a)(8)](/systems/trust-and-governance/criteria/hipaa/164-308-a-8) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Control sameness](/systems/trust-and-governance/controls/control-sameness) | detective | [SOC2 CC4.1](/systems/trust-and-governance/criteria/soc2/cc4-1), [SOC2 CC5.2](/systems/trust-and-governance/criteria/soc2/cc5-2) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Adversarial control testing](/systems/trust-and-governance/controls/adversarial-testing) | detective | [SOC2 CC4.1](/systems/trust-and-governance/criteria/soc2/cc4-1), [ISO27001 A.5.35](/systems/trust-and-governance/criteria/iso27001/a-5-35) | [Tester](/agents/quality/tester) |
| [Deviation closure](/systems/trust-and-governance/controls/deviation-closure) | detective | [SOC2 CC4.2](/systems/trust-and-governance/criteria/soc2/cc4-2), [ISO27001 A.5.36](/systems/trust-and-governance/criteria/iso27001/a-5-36) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Authenticated Actions](/systems/trust-and-governance/controls/authenticated-actions) | preventive | [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1), [ISO27001 A.5.16](/systems/trust-and-governance/criteria/iso27001/a-5-16), [ISO27001 A.8.5](/systems/trust-and-governance/criteria/iso27001/a-8-5), [HIPAA 164.312(d)](/systems/trust-and-governance/criteria/hipaa/164-312-d) | [Security Engineer](/agents/engineering/security-engineer) |
| [Task-bound access](/systems/trust-and-governance/controls/task-bound-access) | preventive | [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1), [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3), [ISO27001 A.5.15](/systems/trust-and-governance/criteria/iso27001/a-5-15), [HIPAA 164.308(a)(4)](/systems/trust-and-governance/criteria/hipaa/164-308-a-4), [HIPAA 164.312(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-312-a-1) | [Security Engineer](/agents/engineering/security-engineer) |
| [Permission decay](/systems/trust-and-governance/controls/permission-decay) | detective | [SOC2 CC6.2](/systems/trust-and-governance/criteria/soc2/cc6-2), [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3), [ISO27001 A.5.18](/systems/trust-and-governance/criteria/iso27001/a-5-18), [HIPAA 164.308(a)(4)](/systems/trust-and-governance/criteria/hipaa/164-308-a-4) | [Security Engineer](/agents/engineering/security-engineer) |
| [Permission widening](/systems/trust-and-governance/controls/permission-widening) | preventive | [SOC2 CC6.2](/systems/trust-and-governance/criteria/soc2/cc6-2), [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3), [ISO27001 A.8.2](/systems/trust-and-governance/criteria/iso27001/a-8-2), [ISO27001 A.5.18](/systems/trust-and-governance/criteria/iso27001/a-5-18) | [Security Engineer](/agents/engineering/security-engineer) |
| [Unseated access](/systems/trust-and-governance/controls/unseated-access) | detective | [SOC2 CC6.2](/systems/trust-and-governance/criteria/soc2/cc6-2), [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3), [ISO27001 A.6.5](/systems/trust-and-governance/criteria/iso27001/a-6-5), [HIPAA 164.308(a)(3)](/systems/trust-and-governance/criteria/hipaa/164-308-a-3) | [Security Engineer](/agents/engineering/security-engineer) |
| [Secret rotation](/systems/trust-and-governance/controls/secret-rotation) | detective | [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1), [ISO27001 A.5.17](/systems/trust-and-governance/criteria/iso27001/a-5-17) | [Security Engineer](/agents/engineering/security-engineer) |
| [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation) | preventive | [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1), [SOC2 C1.1](/systems/trust-and-governance/criteria/soc2/c1-1), [ISO27001 A.8.3](/systems/trust-and-governance/criteria/iso27001/a-8-3), [GDPR Art.32](/systems/trust-and-governance/criteria/gdpr/art-32) | [Security Engineer](/agents/engineering/security-engineer) |
| [Encryption](/systems/trust-and-governance/controls/encryption) | preventive | [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1), [SOC2 CC6.7](/systems/trust-and-governance/criteria/soc2/cc6-7), [ISO27001 A.8.24](/systems/trust-and-governance/criteria/iso27001/a-8-24), [HIPAA 164.312(e)(1)](/systems/trust-and-governance/criteria/hipaa/164-312-e-1), [GDPR Art.32](/systems/trust-and-governance/criteria/gdpr/art-32) | [Security Engineer](/agents/engineering/security-engineer) |
| [Boundary protection](/systems/trust-and-governance/controls/boundary-protection) | preventive | [SOC2 CC6.6](/systems/trust-and-governance/criteria/soc2/cc6-6), [ISO27001 A.8.20](/systems/trust-and-governance/criteria/iso27001/a-8-20) | [Security Engineer](/agents/engineering/security-engineer) |
| [Vulnerability management](/systems/trust-and-governance/controls/vulnerability-management) | detective | [SOC2 CC7.1](/systems/trust-and-governance/criteria/soc2/cc7-1), [ISO27001 A.8.8](/systems/trust-and-governance/criteria/iso27001/a-8-8) | [Security Engineer](/agents/engineering/security-engineer) |
| [Deploy reconciliation](/systems/trust-and-governance/controls/deploy-reconciliation) | detective | [SOC2 CC6.8](/systems/trust-and-governance/criteria/soc2/cc6-8), [SOC2 CC7.1](/systems/trust-and-governance/criteria/soc2/cc7-1), [SOC2 CC8.1](/systems/trust-and-governance/criteria/soc2/cc8-1), [ISO27001 A.8.9](/systems/trust-and-governance/criteria/iso27001/a-8-9) | [Reliability Engineer](/agents/engineering/reliability-engineer) |
| [Append-only records](/systems/trust-and-governance/controls/append-only-records) | preventive | [SOC2 CC7.2](/systems/trust-and-governance/criteria/soc2/cc7-2), [SOC2 PI1.5](/systems/trust-and-governance/criteria/soc2/pi1-5), [ISO27001 A.5.33](/systems/trust-and-governance/criteria/iso27001/a-5-33), [HIPAA 164.312(c)(1)](/systems/trust-and-governance/criteria/hipaa/164-312-c-1) | [Security Engineer](/agents/engineering/security-engineer) |
| [Anomaly monitoring](/systems/trust-and-governance/controls/anomaly-monitoring) | detective | [SOC2 CC7.2](/systems/trust-and-governance/criteria/soc2/cc7-2), [SOC2 CC7.3](/systems/trust-and-governance/criteria/soc2/cc7-3), [ISO27001 A.8.16](/systems/trust-and-governance/criteria/iso27001/a-8-16) | [Reliability Engineer](/agents/engineering/reliability-engineer) |
| [Incident handling](/systems/trust-and-governance/controls/incident-handling) | detective | [SOC2 CC7.3](/systems/trust-and-governance/criteria/soc2/cc7-3), [SOC2 CC7.4](/systems/trust-and-governance/criteria/soc2/cc7-4), [SOC2 CC7.5](/systems/trust-and-governance/criteria/soc2/cc7-5), [ISO27001 A.5.24](/systems/trust-and-governance/criteria/iso27001/a-5-24), [ISO27001 A.5.26](/systems/trust-and-governance/criteria/iso27001/a-5-26), [HIPAA 164.308(a)(6)](/systems/trust-and-governance/criteria/hipaa/164-308-a-6) | [Reliability Engineer](/agents/engineering/reliability-engineer) |
| [Revert by query](/systems/trust-and-governance/controls/revert-by-query) | detective | [SOC2 CC7.4](/systems/trust-and-governance/criteria/soc2/cc7-4), [SOC2 CC7.5](/systems/trust-and-governance/criteria/soc2/cc7-5), [ISO27001 A.5.26](/systems/trust-and-governance/criteria/iso27001/a-5-26) | [Reliability Engineer](/agents/engineering/reliability-engineer) |
| [Breach notification](/systems/trust-and-governance/controls/breach-notification) | detective | [SOC2 CC7.3](/systems/trust-and-governance/criteria/soc2/cc7-3), [SOC2 P6.3](/systems/trust-and-governance/criteria/soc2/p6-3), [SOC2 P6.6](/systems/trust-and-governance/criteria/soc2/p6-6), [HIPAA 164.404](/systems/trust-and-governance/criteria/hipaa/164-404), [GDPR Art.33](/systems/trust-and-governance/criteria/gdpr/art-33), [GDPR Art.34](/systems/trust-and-governance/criteria/gdpr/art-34) | [Privacy Officer](/agents/legal/privacy-officer) |
| [Change approval](/systems/trust-and-governance/controls/change-approval) | preventive | [SOC2 CC8.1](/systems/trust-and-governance/criteria/soc2/cc8-1), [ISO27001 A.5.3](/systems/trust-and-governance/criteria/iso27001/a-5-3), [ISO27001 A.8.25](/systems/trust-and-governance/criteria/iso27001/a-8-25), [ISO27001 A.8.32](/systems/trust-and-governance/criteria/iso27001/a-8-32) | [Engineering Lead](/agents/engineering/engineering-lead) |
| [Agent definition evals](/systems/trust-and-governance/controls/agent-definition-evals) | preventive | [SOC2 CC8.1](/systems/trust-and-governance/criteria/soc2/cc8-1), [ISO27001 A.8.29](/systems/trust-and-governance/criteria/iso27001/a-8-29) | [Quality Lead](/agents/quality/quality-lead) |
| [Environment separation](/systems/trust-and-governance/controls/environment-separation) | preventive | [SOC2 CC8.1](/systems/trust-and-governance/criteria/soc2/cc8-1), [ISO27001 A.8.31](/systems/trust-and-governance/criteria/iso27001/a-8-31) | [Engineering Lead](/agents/engineering/engineering-lead) |
| [Upstream review](/systems/trust-and-governance/controls/upstream-review) | detective | [SOC2 CC9.2](/systems/trust-and-governance/criteria/soc2/cc9-2), [SOC2 CC6.4](/systems/trust-and-governance/criteria/soc2/cc6-4), [SOC2 CC6.5](/systems/trust-and-governance/criteria/soc2/cc6-5), [SOC2 P6.4](/systems/trust-and-governance/criteria/soc2/p6-4), [SOC2 P6.5](/systems/trust-and-governance/criteria/soc2/p6-5), [ISO27001 A.5.19](/systems/trust-and-governance/criteria/iso27001/a-5-19), [ISO27001 A.5.22](/systems/trust-and-governance/criteria/iso27001/a-5-22), [ISO27001 A.5.23](/systems/trust-and-governance/criteria/iso27001/a-5-23), [HIPAA 164.310(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-310-a-1), [GDPR Art.28](/systems/trust-and-governance/criteria/gdpr/art-28) | [Compliance Officer](/agents/legal/compliance-officer) |
| [Health data agreements](/systems/trust-and-governance/controls/health-data-agreements) | preventive | [HIPAA 164.308(b)(1)](/systems/trust-and-governance/criteria/hipaa/164-308-b-1) | [Contracts Manager](/agents/legal/contracts-manager) |
| [Capacity headroom](/systems/trust-and-governance/controls/capacity-headroom) | detective | [SOC2 A1.1](/systems/trust-and-governance/criteria/soc2/a1-1), [ISO27001 A.8.6](/systems/trust-and-governance/criteria/iso27001/a-8-6) | [Reliability Engineer](/agents/engineering/reliability-engineer) |
| [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery) | detective | [SOC2 A1.2](/systems/trust-and-governance/criteria/soc2/a1-2), [SOC2 A1.3](/systems/trust-and-governance/criteria/soc2/a1-3), [SOC2 CC7.5](/systems/trust-and-governance/criteria/soc2/cc7-5), [SOC2 CC9.1](/systems/trust-and-governance/criteria/soc2/cc9-1), [ISO27001 A.8.13](/systems/trust-and-governance/criteria/iso27001/a-8-13), [ISO27001 A.5.29](/systems/trust-and-governance/criteria/iso27001/a-5-29), [ISO27001 A.5.30](/systems/trust-and-governance/criteria/iso27001/a-5-30), [HIPAA 164.308(a)(7)](/systems/trust-and-governance/criteria/hipaa/164-308-a-7) | [Reliability Engineer](/agents/engineering/reliability-engineer) |
| [Processing definitions](/systems/trust-and-governance/controls/processing-definitions) | preventive | [SOC2 PI1.1](/systems/trust-and-governance/criteria/soc2/pi1-1) | [Product Lead](/agents/product/product-lead) |
| [Input validation](/systems/trust-and-governance/controls/input-validation) | preventive | [SOC2 PI1.2](/systems/trust-and-governance/criteria/soc2/pi1-2) | [Engineering Lead](/agents/engineering/engineering-lead) |
| [Action completion](/systems/trust-and-governance/controls/action-completion) | detective | [SOC2 PI1.3](/systems/trust-and-governance/criteria/soc2/pi1-3), [SOC2 PI1.4](/systems/trust-and-governance/criteria/soc2/pi1-4) | [Quality Lead](/agents/quality/quality-lead) |
| [Outcome confirmation](/systems/trust-and-governance/controls/outcome-confirmation) | preventive | [SOC2 PI1.4](/systems/trust-and-governance/criteria/soc2/pi1-4) | [Delivery Manager](/agents/operations/delivery-manager) |
| [Privacy notice](/systems/trust-and-governance/controls/privacy-notice) | detective | [SOC2 P1.1](/systems/trust-and-governance/criteria/soc2/p1-1), [GDPR Art.13](/systems/trust-and-governance/criteria/gdpr/art-13) | [Legal Lead](/agents/legal/legal-lead) |
| [Lawful basis](/systems/trust-and-governance/controls/lawful-basis) | preventive | [SOC2 P2.1](/systems/trust-and-governance/criteria/soc2/p2-1), [SOC2 P3.1](/systems/trust-and-governance/criteria/soc2/p3-1), [SOC2 P3.2](/systems/trust-and-governance/criteria/soc2/p3-2), [SOC2 P6.1](/systems/trust-and-governance/criteria/soc2/p6-1), [GDPR Art.6](/systems/trust-and-governance/criteria/gdpr/art-6), [GDPR Art.7](/systems/trust-and-governance/criteria/gdpr/art-7) | [Privacy Officer](/agents/legal/privacy-officer) |
| [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation) | preventive | [SOC2 P4.1](/systems/trust-and-governance/criteria/soc2/p4-1), [SOC2 C1.1](/systems/trust-and-governance/criteria/soc2/c1-1), [ISO27001 A.5.34](/systems/trust-and-governance/criteria/iso27001/a-5-34), [GDPR Art.5](/systems/trust-and-governance/criteria/gdpr/art-5), [GDPR Art.25](/systems/trust-and-governance/criteria/gdpr/art-25) | [Privacy Officer](/agents/legal/privacy-officer) |
| [Retention restriction](/systems/trust-and-governance/controls/retention-restriction) | preventive | [SOC2 C1.2](/systems/trust-and-governance/criteria/soc2/c1-2), [SOC2 P4.2](/systems/trust-and-governance/criteria/soc2/p4-2), [SOC2 P4.3](/systems/trust-and-governance/criteria/soc2/p4-3) | [Privacy Officer](/agents/legal/privacy-officer) |
| [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) | detective | [SOC2 P5.1](/systems/trust-and-governance/criteria/soc2/p5-1), [SOC2 P5.2](/systems/trust-and-governance/criteria/soc2/p5-2), [SOC2 P7.1](/systems/trust-and-governance/criteria/soc2/p7-1), [SOC2 P8.1](/systems/trust-and-governance/criteria/soc2/p8-1), [GDPR Art.15](/systems/trust-and-governance/criteria/gdpr/art-15), [GDPR Art.16](/systems/trust-and-governance/criteria/gdpr/art-16), [GDPR Art.17](/systems/trust-and-governance/criteria/gdpr/art-17), [GDPR Art.20](/systems/trust-and-governance/criteria/gdpr/art-20), [GDPR Art.21](/systems/trust-and-governance/criteria/gdpr/art-21) | [Privacy Officer](/agents/legal/privacy-officer) |
| [Disclosure record](/systems/trust-and-governance/controls/disclosure-record) | detective | [SOC2 P6.1](/systems/trust-and-governance/criteria/soc2/p6-1), [SOC2 P6.2](/systems/trust-and-governance/criteria/soc2/p6-2), [SOC2 P6.7](/systems/trust-and-governance/criteria/soc2/p6-7) | [Privacy Officer](/agents/legal/privacy-officer) |
| [Records of processing](/systems/trust-and-governance/controls/processing-records) | detective | [GDPR Art.30](/systems/trust-and-governance/criteria/gdpr/art-30), [SOC2 P6.7](/systems/trust-and-governance/criteria/soc2/p6-7) | [Privacy Officer](/agents/legal/privacy-officer) |
| [Supplier bank details](/systems/trust-and-governance/controls/supplier-bank-details) | preventive | None. | [Treasurer](/agents/finance/treasurer) |
| [Segregation of duties](/systems/trust-and-governance/controls/segregation-of-duties) | preventive | [SOC2 CC5.1](/systems/trust-and-governance/criteria/soc2/cc5-1) | [Finance Lead](/agents/finance/finance-lead) |
| [Reconciliation completeness](/systems/trust-and-governance/controls/reconciliation-completeness) | preventive | [SOC2 PI1.4](/systems/trust-and-governance/criteria/soc2/pi1-4) | [Finance Lead](/agents/finance/finance-lead) |
| [Manual Entry review](/systems/trust-and-governance/controls/manual-entry-review) | preventive | [SOC2 PI1.2](/systems/trust-and-governance/criteria/soc2/pi1-2) | [Finance Lead](/agents/finance/finance-lead) |
| [Period sign-off](/systems/trust-and-governance/controls/period-sign-off) | detective | [SOC2 CC4.1](/systems/trust-and-governance/criteria/soc2/cc4-1) | [Finance Lead](/agents/finance/finance-lead) |
| [Bank detail changes](/systems/trust-and-governance/controls/bank-detail-changes) | preventive | [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1) | [Treasurer](/agents/finance/treasurer) |