SOC 2 Type II Evidence Report

Overview

SOC 2 Type II is an attestation report covering how a service organization's controls operate over a period of time (typically 6–12 months). The Trust Services Criteria (TSC) cover Security, Availability, Confidentiality, Processing Integrity, and Privacy.

Koalr's SOC 2 report focuses on three Common Criteria that map directly to engineering change management evidence. The report is designed to be delivered to your licensed CPA firm during SOC 2 fieldwork.

Controls covered

CC8.1 — Change Management

Control language: The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures.

Koalr evidence: Every merged pull request has a recorded peer review, risk score, and approval before reaching production. The report surfaces:

• Total changes in the reporting period
• Percentage with required approval before merge
• PRs merged with zero reviews (control exception)
• Rubber-stamp approvals (under 2 minutes with no comments)

CC6.1 — Logical Access Controls

Control language: The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events.

Koalr evidence: CODEOWNERS rules enforce that changes to sensitive paths are reviewed by designated authorized owners. The report tracks CODEOWNERS compliance on every merged PR. Violations are treated as access control exceptions.

CC9.2 — Risk Assessment of Changes

Control language: The entity assesses and manages risks associated with vendors and business partners.

Koalr evidence: Automated deploy risk scoring evaluates every change for DDL migrations, blast radius, CVE-adjacent paths, and complexity before merge. High-risk changes are flagged for mandatory review. The report surfaces:

• Percentage of changes risk-scored
• Average risk score across the period
• Count of HIGH and CRITICAL flagged changes

Report output

PDF evidence package

• Dark navy cover page with SOC 2 Trust Services Criteria badges (CC8.1, CC6.1, CC9.2), metadata block prepared for CPA firm review
• Executive summary with six KPI tiles
• Per-control detail blocks with status badge (EVIDENCED / PARTIAL / NOT_COVERED) and evidence count
• Change log table with approval, CODEOWNERS, and risk columns mapped to each control
• Page number footer with CONFIDENTIAL marking

CSV export

PR #, Title, Repository, Author, Merged At, CC8.1 Approval, CC6.1 CODEOWNERS OK, CC9.2 Risk Score, Risk Level, DDL Migration, Changed Files, Additions, Deletions, Reviewers

Generating a report

1. Navigate to Compliance → SOC 2 Type II
2. Select your reporting period (typically the full audit period, e.g., January 1 – December 31)
3. Optionally filter by a single repository
4. Click Download evidence package for the PDF
5. Click Export CSV for machine-readable output

SOC 2 workflow integration

SOC 2 Type II fieldwork typically requires evidence samples. When your CPA firm requests a sample of changes:

1. Use the date picker to bracket the sample window
2. Export the CSV — every change in scope is listed with all control evidence fields
3. Share both the PDF (for narrative) and CSV (for sampling) with the auditor

For ongoing monitoring between audit periods, consider setting up a scheduled quarterly report generation workflow.

Integration requirements

• GitHub (required) — provides all change management data
• Optional: Jira or Linear for ticket-to-PR traceability

CPA firm review notes

• The PDF cover page explicitly names "SOC 2 Type II Audit — Trust Services Criteria CC8.1, CC6.1, CC9.2" in the Prepared For field
• Koalr captures raw event data — the control status is computed deterministically from that data using the evidence thresholds documented in the compliance overview
• Changes to the underlying data (e.g., late-arriving review events) are reflected on the next report generation — the report timestamp is shown on the cover page
• For non-technical SOC 2 evidence (e.g., vendor management, HR controls), pair the Koalr report with your broader compliance documentation

Disclaimer

This report is designed to support SOC 2 Type II evidence collection. It does not constitute a formal audit opinion or attestation. Engage a licensed CPA firm with SOC 2 examination experience for your official report.