CC1.5 Accountability for internal control: SOC 2 evidence

What CC1.5 asks SOC 2 auditors to see in practice

If you are the compliance lead, the auditor will eventually ask two questions about every control: who owns it, and what happens when that person falls short. CC1.5 restates COSO Principle 5, which asks the organization to hold individuals accountable for their internal control responsibilities. In practice, the auditor is looking for a visible line from each control to a named person, a measure of how that person performs, and a response when performance drops. A control that exists only in a policy document, with no owner who is ever evaluated on it, is the gap this criterion is written to catch.

The risk is easy to miss because it lives between functions. HR owns performance reviews and incentives, management owns objectives and staffing, and security owns the controls themselves. When each function assumes another is tracking control ownership, controls drift: access reviews slip, vendor reassessments lapse and nobody notices until the examination period is already underway. The 2022 points of focus under CC1.5 group the relevant considerations into structures and authorities, performance measures, incentives and rewards, attention to excessive pressures, and evaluation with rewards or discipline. Read them as prompts for your own design, since they are not separate requirements.

CC1.5 is distinct from CC1.4, which asks whether people are competent enough to perform their roles through hiring, training and succession. CC1.4 answers whether the right people are in place, while CC1.5 asks whether those people are answerable for their control duties. Before your examination window opens, confirm with your auditor how they expect to see owner assignments and performance evaluations, and whether your privacy category is in scope, since the 2017 TSC adds privacy-specific points of focus under CC1.5 as flagged in the NIST Privacy Framework crosswalk.

Which people, roles and decisions does CC1.5 cover

CC1.5 applies to anyone whose work affects internal control, not only the security team. The decisions below determine which people, roles and third parties the organization must hold accountable and how it shows that it did.

Control owners

Every named owner of a control in the control matrix is the first population CC1.5 reaches. Accountability means the owner knows the control is theirs, has the authority to perform it, and is evaluated on whether it runs. Check that each control has one accountable person, that the person appears in the matrix, and that the assignment is written down and reviewed when roles change. Ownership held by a role instead of a person is hard to evidence.

Managers who set targets

Managers set the performance measures and deadlines that shape how staff behave under pressure. If a manager's goals reward shipping speed without any security or change review criteria, the control environment is weaker regardless of the written policy. Ask whether managers receive security objectives, whether those objectives are reviewed periodically, and whether the review is recorded. An auditor will look for the link between stated measures and what the organization actually rewards.

Staff with production access

Engineers, support staff and operators who can change production systems or customer data are where control failures carry the most risk. Their accountability covers approvals they give, access they use, and emergency actions they take outside normal channels. Confirm that each person with production rights knows the expectations attached to that access and that deviations from them are visible and handled. This group usually needs the most explicit consequences documented.

Staff on call

On-call responsibilities place people in incident decisions at unusual hours, often with broad authority and limited oversight. CC1.5 asks whether those people are accountable for how they respond, including escalation, communication and documentation of actions taken. Check that on-call duties are assigned in writing, that handoffs are recorded, and that post-incident reviews assess individual performance against the expected response rather than only the outcome.

Contractors and vendor staff

Contractors who hold access or perform controls, and vendor staff who run parts of the service, are part of the accountability population when they do work the organization relies on. Their accountability is usually set through contracts, statements of work and onboarding terms rather than performance reviews. Confirm that these terms state responsibilities, that the organization can act when they are breached, and that vendor staff who perform controls are named in the evidence trail.

Small companies compared with formal programs

A company with a few owners often holds people accountable informally, through direct oversight and shared knowledge of who does what. That can satisfy the intent of CC1.5 if the decisions are written down and the owners apply them consistently. A larger organization with formal performance cycles must show that its review process includes control responsibilities, not just sales or delivery results. Ask an auditor early which evidence they expect for your size, since the same control can be tested differently.

Privacy points of focus when in scope

CC1.5 includes additional points of focus that apply only when the privacy category is in scope. The NIST crosswalk to the AICPA 2017 Trust Services Criteria flags which points of focus these are. If privacy is not in your system description, do not add them as requirements. If it is, map the privacy responsibilities to named owners before the examination period begins so that the evidence covers the whole period.

How an assessor tests CC1.5 in a Type 2 examination

This table walks through the test steps an assessor usually follows for CC1.5, the evidence each step asks for, and the findings that appear most often. Use it to prepare the records that show accountability operates in practice across the whole observation period, not just on the day the policy was written.

Test step	What the assessor inspects	Common finding to avoid
Responsibility assignments	Documented roles for control owners, such as security policy approval, access review sign-off and vendor risk decisions, with the authority each role holds	Control duties are described in policies but no named person or role is assigned to them
Performance objectives	A sample of objectives or performance reviews for control owners and managers that reference their internal control duties over the period	Objectives never mention security, access reviews or change approval, even for staff who own those controls
Review timing	Evidence that performance reviews and objective check-ins happened on the schedule the organization set	Reviews are documented for some staff or quarters only, or completed after the period they cover
Incentives and rewards	Bonus or recognition criteria and whether control performance is considered where those rewards are granted	Compensation rewards delivery speed or revenue with no offsetting consideration of control outcomes
Pressure consideration	Management's documented review of deadline, revenue or launch pressure and how it was weighed against control steps	No record that management considered pressure, or pressure noted but no change to controls or staffing
Corrective action	Records of discipline, retraining or remediation after a policy breach, including dates, decisions and follow-up checks	Breaches are logged but no decision, consequence or follow-up appears in the record
Evidence requested	Organization charts, role descriptions, signed policies, review records, objective documents, incident or breach tickets and meeting minutes covering the period	Evidence is produced only for the audit date, or the population of breaches is incomplete so sampling cannot be trusted

Sequence for making accountability for controls operate

This sequence turns CC1.5 from a statement of intent into a working accountability model, where each control has a named owner, the owner's duties are written down, measures are reviewed, and deviations lead to documented action. Each step ends with a record an auditor can inspect.

Map each control to a named owner
Start from the control matrix and assign every control, including those inherited from cloud providers and tools, to one accountable person by name and role. Shared responsibilities should be split so that one person answers for each outcome. Compare the matrix with the current org chart to find controls whose owner has left, changed roles or never agreed to the task. The output is a control-to-owner register, signed off by management, that an auditor can trace to each control description.
Write control duties into role descriptions
Add each owner's internal control responsibilities to the written job description, role profile or objectives for that person, using the same wording as the control matrix. Include what the owner must do, how often, and what evidence they must produce. Where a role has no written profile, such as a contractor or a vendor-facing engineer, record the duty in the agreement or onboarding document instead. The output is a set of updated role documents that an auditor can compare with the control register.
Set performance measures for control owners
Agree on measures that show whether each control is operating, such as access review completion, patch timeliness, or training completion rates. Set a target and a review frequency for each measure, and record who sets it and who approves it. Ask whether any incentive or bonus criteria reward speed or output in ways that could pressure owners to skip controls, and note any change needed. The output is a measure register tied to the control owners, which shows how performance is defined before results are reviewed.
Review measures and pressures periodically
At the frequency set in the measure register, management reviews results for each owner, compares them with targets, and asks whether deadlines, staffing or delivery demands are creating pressure to bypass controls. Reviews should include a note on any owner who is consistently late or who reports resource limits. Confirm the review frequency with your own policy and the auditor's expectations before fixing it. The output is a dated review record per owner, with decisions and follow-up items, that an auditor can sample.
Define how deviations lead to action
Write a procedure that says how a missed control, a failed measure or a policy breach is logged, who decides the response, and what range of outcomes applies, from retraining and corrective action plans to formal discipline. Keep the procedure consistent with the organization's human resources policies and employment rules, and have legal or HR review it where needed. The output is a written deviation and consequence procedure, with examples of how it has been applied, kept for the auditor.
Apply remediation or discipline and track closure
When a deviation is logged, the accountable owner documents the root cause, the corrective action, and the date it is closed, and management confirms the closure. Discipline decisions are recorded with the reason and approver, and handled through HR so that records are consistent. Track open items in one register so that repeated deviations by the same owner are visible. The output is a closed-loop log of deviations, actions and approvals that shows accountability was enforced in practice.
Record the accountability review for the auditor
Close the cycle by compiling the control-to-owner register, updated role descriptions, measure reviews, deviation log and management sign-off into one dated package. Confirm that the package covers the full period the auditor will examine, since a Type 2 report depends on evidence across a period. Ask the auditor which samples they expect and how they prefer records to be organized before the review. The output is a dated accountability package that the auditor can inspect, with each item traceable to a control.

How incentives and pressure checks show up in evidence

The points of focus on incentives and excessive pressure are hard to evidence because they describe judgment rather than a system output. An auditor cannot sample a ticket that proves leadership weighed security against a release date. What the auditor can sample is the record that the organization created when it made those choices, so the practical question for a service organization is which records would show that accountability was real. Start by deciding which performance measures for managers and staff include security and control responsibilities, and write down how those measures feed into reviews, bonuses or promotion decisions. An auditor will look for the measure in the written goals, the review that used it, and the decision that followed. A reasonable record is usually modest and specific. Examples of the kind of evidence to consider, described here as illustrative only, include leadership meeting minutes where the team reviewed the security backlog against the product roadmap and recorded what was deferred and who approved it; a policy stating that security exceptions are not waived for schedule reasons and that any exception needs documented risk acceptance by a named owner; and a log of exception approvals showing the approver, expiry date and compensating control. Confirm with your own auditor which formats they accept and how many periods of records they expect, because the required sample size and period depend on whether the engagement is a Type 1 or Type 2 examination.

The organization chooses its own measures, thresholds and consequences, and the auditor evaluates whether they operate as described. That means a measure you define loosely, or one nobody reviews, will produce weak evidence even if the intent is sound. Before fieldwork, run a dry check: pick one recent release or one recent security exception and trace it back through the approval record, the review of who was accountable, and any consequence applied. If the trail breaks at any point, fix the process and the records before the observation period starts. Ask your auditor to confirm in writing how they plan to test accountability for internal control, and ask your implementation partner to help define the evidence trail, not to decide the outcome. Independent assessment remains the auditor's responsibility, and the organization remains accountable for the controls it reports on.

Evidence that passes CC1.5 and how to keep it current

An auditor testing CC1.5 looks for proof that people were held to their control duties, not just a statement that they were. The six artifacts below form that proof, and each one has to be refreshed across the Type 2 observation period rather than assembled the week before fieldwork.

Role and responsibility matrix

A matrix that maps each internal control to a named owner, a backup and the reviewer who checks the owner's work. It is the baseline the auditor uses to decide who should be accountable for what. Check that every control in your control matrix has an owner, that owners still hold the role, and that departures were reflected within the period in which they happened. Date each revision and keep the prior versions so the auditor can see which assignments applied on which dates.

Objectives and performance reviews

Written objectives for security, compliance and operations roles, including explicit control duties such as completing access reviews or approving changes. Reviews against those objectives show the organization evaluating performance on control work, not only on delivery. Confirm that control duties appear in the objectives themselves, that reviews happen on the cycle you documented, and that gaps raised in review are tracked to closure. Reviews that never mention controls are weak evidence even when the review itself is complete.

Control review sign-off records

Dated records showing that owners performed recurring control activities and that a reviewer checked them, such as quarterly access review sign-offs or vulnerability review approvals. These records show accountability in operation, which is what a Type 2 opinion tests over time. Keep the signer, the date, the scope reviewed and any exceptions found. A sign-off without a visible reviewer, or one signed months after the activity it covers, invites questions about whether the review actually happened.

Incentive and compensation policy

A written statement of how bonuses, promotions and other rewards treat control performance, including whether control failures reduce variable pay. CC1.5 expects management to consider whether incentives push people toward shortcuts, such as shipping before security review or closing tickets without evidence. Confirm the policy is approved, that it matches what managers actually do, and that the organization can show how it weighed control results in any year where bonuses were paid. Ask counsel to review any employment-law implications before publishing.

Corrective action and discipline records

Records of control failures, the corrective action taken and any consequence for the individual responsible, such as retraining, a revised objective or a documented sanction. Auditors often sample these to see whether accountability is consistent. Keep the root cause, the date opened and closed, and the approver. An organization with no recorded control failures in a year deserves a question from the auditor, so be ready to explain how deviations would have been detected and recorded.

Management meeting minutes

Minutes from management or security governance meetings that show leaders reviewing control performance, discussing pressures such as deadlines or staffing, and assigning follow-up to named people. These minutes connect the abstract accountability structure to decisions made in practice. Check that actions carry an owner and a due date, that open items are carried forward to later meetings, and that the meetings occur on a regular cadence across the whole observation period.

What meeting CC1.5 costs in money and effort

This table lists the cost components of keeping CC1.5 accountability working for a SOC 2, who pays for each, whether it is one-time or recurring, and what drives it up or down. No prices are given because none are supplied; use the columns to build a comparable quote request. The main takeaway is that most of the cost is internal management time, which recurs every review cycle.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it
Objectives and performance measures for control owners	Managers and HR, with security or compliance input	One-time to set up, then recurring at each review	Number of control owners and roles with security responsibilities
Review of incentive and reward structures	HR, finance and leadership	Recurring, usually at each annual performance cycle	Size of the organization and how many bonus or incentive plans exist
Legal or HR review of policy and disciplinary language	Internal counsel or outside employment counsel, billed by hour or retainer	One-time for drafting, recurring if the policy changes	Jurisdictions where staff work and how often policies are revised
Evidence of accountability actions (reviews, sign-offs, discipline records)	Managers and HR operations	Recurring across the whole observation period	Frequency of reviews and how records are kept, such as a ticketing or HR system
GRC or HR tooling used to track objectives and sign-offs	Software vendor, paid by subscription or licence, or self-hosted by the organization	Recurring license or hosting cost, plus one-time setup	Whether tools are bought or built from open-source components, and number of users
Auditor sampling and walkthroughs of CC1.5 controls	Independent CPA firm, under the engagement letter	Recurring at each examination period	Number of control owners sampled and the number of review cycles in the period
External advisory for design and readiness	Consultants or implementation partners, under a written fixed scope	One-time for design, optional recurring for support	Gaps found in readiness, and whether the organization drafts its own objectives

Who owns accountability, who prepares evidence, and who tests it

Your management team owns the accountability decisions behind CC1.5. Leadership decides who is responsible for each internal control, which performance measures apply to those responsibilities, how bonuses and promotions reflect control performance, and what happens when someone breaks a control. These choices are business decisions. An auditor will not make them for you, and an implementation partner should not make them on your behalf, because the evidence only means something if the people who run the company stand behind it.

Named control owners: Each control in your matrix needs a person who answers for it, recorded by name and role, not by team alone.
Performance measures: Define how control duties feed into objectives, such as completing access reviews on schedule or closing vulnerability tickets within your own stated window.
Incentive decisions: Decide whether control performance affects compensation or reviews, and document the rule before the observation period starts.
Pressure review: Record how leadership considers deadline or revenue pressure that might push staff to skip controls.
Discipline records: Keep a written standard for consequences of control failures and apply it consistently.

Before fieldwork, confirm that each named owner has accepted their responsibilities in writing and that the signed record is retained.

Where CC1.5 fails in practice and how to close it

Most CC1.5 findings are not missing policies. They are gaps between what the organization says about accountability and what its job descriptions, objectives, records and review calendar show. Each card below names one gap, why an assessor notices it, and the fix that leaves dated evidence behind.

Control duties missing from job descriptions

People are often held responsible for controls that appear only in a policy, not in their role. Access reviews, change approvals and incident escalation get assigned to a team in a document no one signs. Add each control owner's duties to their job description or role card, then have the individual acknowledge them. When checking, pick three control owners at random and confirm their written role says what they actually do for the control.

Objectives that reward speed over security

When a team's quarterly objectives measure only release volume or uptime for a new feature, staff have a reason to skip security steps. Set at least one objective per owner that includes a control result, such as on-time completion of access reviews or closed findings. Review the objectives with the control owner's manager at the start of each period. An assessor will compare the objectives against the control results to see whether the incentives and the controls point the same way.

No record of consequences for breaches

Many organizations have a disciplinary policy but cannot show it was ever applied, or that a breach led to a documented outcome. An empty record is not proof of good behavior, and it weakens the claim that accountability is enforced. Keep a log of policy breaches, the decision taken, who decided and the follow-up, even when the outcome is coaching only. Confirm with counsel and HR how the log will be handled and who may see it.

Reviews that lapse for a quarter

Performance and control reviews often run on a calendar that slips during busy periods, leaving a gap in the record. Under a Type 2 examination, a missed cycle in the observation period is an exception an auditor must describe. Put each recurring review on a shared calendar with a named owner and a backup, and file the completed review as evidence on the day it happens. Check the calendar against the observation period before fieldwork begins.

Privacy points of focus missed

When the privacy category is in scope, the CC1.5 points of focus add expectations that are easy to overlook because the common criteria read as security-only. Check the NIST crosswalk to see which privacy points of focus apply, then assign owners for privacy accountability, such as who answers for data handling decisions and how privacy-related objectives are set. Document the mapping in the control matrix so the auditor can trace each point of focus to an owner and record.

Questions buyers ask about CC1.5 cost, effort and outside help

Can we do CC1.5 accountability without a consultant?

Yes, in principle. The organization owns its controls, so its own leaders must define who is accountable for each internal control responsibility, how performance is measured and how exceptions are handled. An outside partner is not required to make those decisions. What usually needs outside help is the evidence side: mapping roles to written responsibilities, organizing records so an auditor can sample them, and checking the design before fieldwork. Whether your team has the time and experience to do this well is the real question. Ask your auditor which artifacts they expect to see for CC1.5 before you decide how much to build yourselves.

How much internal effort does CC1.5 take?

The effort is mostly in management time rather than engineering time. Expect internal work in four areas: naming the people accountable for each control, writing down the performance expectations tied to security responsibilities, deciding how those expectations are reviewed, and recording any reward or disciplinary action taken on control failures. The effort recurs, because review cycles and role changes continue after the first report. The size of the effort depends on headcount, how many teams carry control duties, and whether performance reviews already include security expectations. Ask any partner to estimate effort from a written scope rather than from a generic template.

How long must CC1.5 evidence cover in a Type 2 report?

A SOC 2 Type 2 report covers an observation period over which the auditor tests whether controls operated effectively. For CC1.5, the evidence must show that accountability measures were applied throughout that period, not only at the start. Typical evidence includes dated role descriptions, performance review records that reference security responsibilities, and records of any disciplinary or reward decisions. The length of the observation period is set in the engagement with your CPA firm, so confirm the start date and length in your engagement letter and plan evidence collection for the whole window.

Do we have to replace our HR software to meet CC1.5?

No. The criterion does not prescribe a tool. Accountability can be evidenced in an existing HR system, a spreadsheet, a ticketing workflow or a document repository, provided the records are complete, dated and retrievable for the auditor. Replacing HR software is a business decision that carries its own cost, data migration work and change risk. Before you consider it, check whether your current records can answer the auditor's sample requests. If they cannot, a targeted export or structured log may close the gap at lower cost than a platform change.

Can the auditor help us design CC1.5 controls?

An independent CPA firm performing the examination cannot design your controls and then test them, because that would compromise its independence. The auditor can explain what it will test and what evidence it expects, and it can review your design against the criteria. Design and implementation work belongs to your organization or to an implementation partner you engage separately. Ask the auditor in writing which parts of preparation it can review and which it cannot perform, and keep that boundary in your engagement documents.

What should we ask for in a partner's scope for CC1.5?

A written scope should name the deliverables, the systems involved and the responsibilities of each party. For CC1.5, ask the partner to list the roles and accountability structures it will document, the performance and review records it will set up, and how it will organize evidence for the auditor. Confirm what the partner will not do, such as signing management representations or issuing any opinion, which remain with your management and the independent auditor. Ask for the timeline, the acceptance criteria for each deliverable and the process for changes. DeployOpen works from fixed, written scopes, and a quote follows from that scope.

What changes for CC1.5 when privacy is in scope

When the privacy category is in scope, CC1.5 gains points of focus that the base common criteria do not carry. The 2017 Trust Services Criteria add these only for privacy, and the NIST-hosted crosswalk between the Privacy Framework and the TSC is the place that flags which CC1.5 points apply in that case. Treat the crosswalk as a map to the relevant points, not as a substitute for them. Before you finalize your control matrix, open the current TSC document and list the privacy-only points of focus under CC1.5 yourself, then confirm the list with your CPA firm, since the auditor decides how they are tested within your system description.

In practice, the privacy points push accountability past the security team and into the people who decide how personal information is collected, used, retained and disposed of. For a service organization, that usually means naming an owner for privacy commitments, tying privacy responsibilities into job descriptions and performance goals, and checking whether any incentive or delivery pressure could lead staff to bypass privacy steps. Ask your auditor which roles they expect to see named, and whether they will sample privacy responsibilities alongside security ones.

The evidence follows the same logic as the base criterion but covers a wider set of people and decisions. Expect to show privacy role assignments, the performance objectives that reference them, records of periodic review of those objectives, and documented consequences where privacy obligations were not met. Where privacy depends on processes owned by other teams, such as support, sales engineering or data engineering, collect evidence from those teams too. Confirm with your auditor how far the privacy criteria reach into your environment before you start collecting, because gaps discovered at fieldwork are costly to close.

How DeployOpen prepares CC1.5 evidence for your audit

DeployOpen plans, implements and documents the self-hosted open-source platforms that record who owns each internal control and how that ownership is checked. The organization keeps ownership of its controls and decides how accountability is enforced, while DeployOpen prepares the systems, records and evidence an independent CPA firm will examine.

How we scope

Engagements are fixed-scope, with control owners, accountability records and review cadence agreed in writing before work starts.
We confirm which systems hold responsibility matrices, objective records and review sign-offs for CC1.5 Accountability for internal control.
The written scope states whether privacy category points of focus apply, based on the categories included in your SOC 2 examination.

How we build

We configure self-hosted tools so each internal control has a named owner, a recorded responsibility and a review history.
We set up recurring review workflows for performance objectives tied to control duties, so reviews leave timestamped records.
We build exception tracking so control failures, pressure-related concerns and resulting discipline or corrective action are logged.

How we hand over

We deliver a control narrative and mapping showing how each CC1.5 point of focus is met and where its evidence is stored.
We provide an evidence index with example records, export procedures and retention settings for the independent auditor's sampling.
We document operating procedures so your staff can run accountability reviews and produce evidence without ongoing DeployOpen involvement.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, keeping accountability records current between audits.
Support covers changes to roles, reporting lines and tooling, which can affect who is accountable for each control.
Confirm with your CPA firm which evidence formats it accepts before finalizing the evidence index and review cadence.