AI Reviewer Template: SOC 2 Policy Reviewer

A compliance reviewer for technology companies and service organisations preparing for or maintaining SOC 2 Type I or Type II audits. This reviewer evaluates policies, procedures, and control documentation against the AICPA Trust Services Criteria across all five categories: security (common criteria), availability, processing integrity, confidentiality, and privacy. It checks that policies address required control activities, are appropriately detailed, and provide auditable evidence of control operation. The reviewer flags common SOC 2 audit findings including policies that are too generic, missing control owner assignments, inadequate monitoring and logging procedures, incomplete incident response plans, and insufficient vendor management documentation. This is essential for SaaS companies and managed service providers where SOC 2 compliance is a customer requirement and competitive differentiator.