SOC 2 PI1.1: Quality Information for Processing Integrity
Processing integrity—the accuracy, completeness, and authorization of information processing—depends entirely on the quality of data flowing through your systems. SOC 2 PI1.1 requires your organization to obtain and use relevant, quality information that directly supports your internal controls and processing integrity commitments. This foundational control ensures your compliance framework rests on reliable data and information assets.
What this means
PI1.1 mandates that your organization establish processes to acquire, generate, and maintain high-quality information used to operate your internal controls effectively. Quality information must be relevant, accurate, timely, and sufficient to support decision-making and the achievement of your processing integrity objectives. This includes data about system performance, user activities, transaction processing, and control effectiveness. Organizations must define what constitutes 'quality' for their information assets and ensure information sources are reliable and validated before use in control operations.
How to comply
- 1.Define quality criteria for all information used in internal control operations (accuracy thresholds, timeliness requirements, completeness standards)
- 2.Identify all sources of information critical to processing integrity (transaction logs, system monitoring data, user activity records)
- 3.Establish validation processes to verify information quality before it's used for control decisions or reporting
- 4.Document information flows from source systems through control points to final use, identifying any transformation or aggregation steps
- 5.Implement controls to detect and correct inaccurate, incomplete, or untimely information before it affects processing integrity
- 6.Assign ownership and accountability for information quality in each processing area
- 7.Review and validate information quality metrics on a regular schedule to ensure ongoing effectiveness
Evidence auditors look for
- Information quality policies defining standards for accuracy, completeness, timeliness, and relevance
- Data validation rules and checks embedded in critical systems or ETL processes
- Source system audits or certifications confirming data reliability
- Information quality metrics and monitoring dashboards showing defect rates, timeliness, and completeness
- Logs of data validation failures and remediation actions taken
- Documentation of information owner assignments and responsibilities
- Evidence of regular quality reviews and trend analysis of information defects
- Reconciliation reports comparing source data to processed information outputs
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
See how GRCWatch handles this control automatically.
See how GRCWatch handles this control automatically
Start free trial