BrowseToolsGuidesComparePricingStacksPlaybooksBlogSearch
ComplianceReadiness checkISO 27001ISO 42001SOC 2PCI DSSPolicy templatesControl mapCompliance softwareFramework compare
SOC 2 Trust Services Criteria

SOC 2 Processing Integrity Criterion

Processing integrity means system processing is complete, accurate, timely, and authorised. It is most relevant for organisations that process data on behalf of others (payment processors, data processors).

SCOPEEVIDENCERISKEVIDENCETESTEVIDENCEREPORTEVIDENCEAUDIT TRAILSOC 2 Processing Integrity EvidencePOLICY / CONTROL / EVIDENCE / REVIEW

Common control areas

Input validation and processing

Define the owner, operating process, sample evidence, exception handling, and review cadence before the audit period starts.

Output verification

Define the owner, operating process, sample evidence, exception handling, and review cadence before the audit period starts.

Error handling

Define the owner, operating process, sample evidence, exception handling, and review cadence before the audit period starts.

Reconciliation procedures

Define the owner, operating process, sample evidence, exception handling, and review cadence before the audit period starts.

Data quality checks

Define the owner, operating process, sample evidence, exception handling, and review cadence before the audit period starts.

Evidence to keep

  • Control owner and review cadence
  • Policy or procedure approved by management
  • System export, ticket, report, or log sample
  • Exception record and remediation evidence

Processing Integrity policy templates

Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.

Incident response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident response, PCI DSS 12.10, and security event handling.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.
Open the control-to-policy map

Back to all SOC 2 criteria, or open the SOC 2 template pack.