Control wake review
A definition Change that wakes a control opens a Task for that control’s owner before it merges.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC3.4 | The entity identifies and assesses changes that could significantly affect the system of internal control. |
| SOC2 CC5.1 | The entity selects and develops control activities that mitigate risks to its objectives to acceptable levels. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every merged definition Change that adds a personal or health field, an upstream, or a Human Worker. |
| Assert | Each has a Task opened before merge and closed by the woken control’s owner. |
Owner
Compliance Officer, Legal Team.
Example
A Change adds patient intake fields to a clinic-scheduling SaaS, which wakes the health data agreements control. A Task opens for the Contracts Manager, who closes it before the Change merges.