Criterion CC4.2The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

What it says

COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

SOC 2, the trust services criteria, CC4.2

What is in the packs for this

From SOC 2 Report Readiness. Each one helps with this requirement.

• XLSExcel

  Trust Services Criteria Response Register

  The register has a row for this criterion, for you to write down your own controls, owners and evidence against it. Lists the 61 Trust Services Criteria by number and series title, with blank columns for your own controls, owners and evidence. It makes no coverage claim.
• DOCWord

  Readiness Assessment Procedure

  Its Framework References cite this criterion. A management-led check before the auditor starts: how to find gaps and exceptions, fix them, and decide when to begin the observation period.
• XLSExcel

  Observation Period & Exceptions Calendar

  Its Framework References cite this criterion. Dates the observation period, the evidence points inside it, any exceptions found and the management responses, and the dates for bridge letters.
• DOCWord

  Bridge Letter & Management Response Templates

  Its Framework References cite this criterion. Templates for the letter that covers the time after a report period ends, for management's response to an exception, and for sharing a report under a confidentiality agreement.