SOC 2 CC2.2: Internal Communication of Control Objectives & Responsibilities

What this means

CC2.2 mandates that your entity establish and maintain processes to communicate control-related information throughout the organization. This includes communicating the importance of internal controls, individual roles and responsibilities within the control environment, how control failures should be reported, and how management expects employees to support compliance objectives. The communication must reach all levels of the organization and be reinforced regularly through multiple channels.

How to comply

1. 1.Document and disseminate a written internal control policy that clearly explains the entity's control framework, key objectives, and expected behaviors
2. 2.Assign specific control responsibilities to individual owners and communicate these assignments in writing to ensure accountability
3. 3.Conduct mandatory training for all employees covering their role in internal controls, the importance of compliance, and how to report control exceptions
4. 4.Establish communication channels (email, intranet, town halls) to regularly reinforce control expectations and share updates on control performance
5. 5.Create role-specific guidance for departments so employees understand which controls apply to their function and their responsibilities
6. 6.Document all internal communications related to controls, including training attendance, policy acknowledgments, and compliance reminders
7. 7.Conduct periodic feedback sessions with staff to ensure control messages are understood and to identify communication gaps

Evidence auditors look for

• Internal control policy document with sign-off from leadership and employee acknowledgment records
• Training materials, agendas, and attendance logs for control-related training sessions
• Role-based control responsibility matrices and job descriptions that define control ownership
• Email campaigns, intranet posts, or town hall meeting notes discussing compliance objectives
• Control procedure documentation distributed to relevant departments with evidence of receipt
• Compliance calendars or newsletters that reinforce control expectations on a regular basis
• Exit interviews or surveys documenting employee understanding of their control responsibilities

Frequently asked questions

GRCWatch automates CC2.2 by centralizing control responsibility assignments, tracking training completion and policy acknowledgments, and maintaining a searchable log of all control-related communications—eliminating manual tracking and providing instant audit evidence.

See how GRCWatch handles this control automatically

Related controls