Key Stakeholder Identification

An audit is not a one-person job. Early in the engagement, define who from the organization will be in charge of each area of the work, drawing from multiple departments. As a lead implementer or consultant, this is also how you meet the team you will be working with for the foreseeable future.

The organization's responsibilities that need named owners:

• Control design
• Control owners
• Evidence collection
• Policy owners
• Managed services
• Identification of subservice providers
• Creation of the system description
• Process and procedure owners
• Management response team

Stakeholder identification matters beyond the org chart: it establishes relationships with the team members you will rely on, which pays off because System and Organization Controls 2 (SOC 2) has a rolling audit period and the same people will be answering for their controls year after year.

This list does not cover everything needed for stakeholder identification. Every organization and platform is different, so take the time to understand the organization, the technology, and most importantly the people who do the work.