SOC 2 Evidence Collection: Controls With Owners and Evidence the Auditor Can Trace

Sixty controls, evidence in four places, and an auditor who reads every label

Before fieldwork, every control in scope needs an owner, evidence that covers the auditor's samples, and a status the compliance lead can stand behind. Each control is an item in ClickUp, grouped by family. The evidence sits in Box, one folder per family. Control owners explain gaps and ask for not-applicable treatment by Outlook, and the owner roster and the auditor's sample table live in Google Drive.

Evidence collection breaks in the details. A screenshot filed under the wrong control makes one control look ready and another look empty. A control has complete evidence, but the owner on the tracker left the team, so nobody can answer for it. An auditor rejects one sample and the control is marked failed, when the right next step was to check whether a valid sample is already in Box.

Who works in the room

Ada is the default agent for the audit period, so an unaddressed question about a control's evidence goes to it. Tracker changes go to Nova, which writes to ClickUp under a lasting grant from the compliance lead once each change is approved. Fin drafts in Gmail and Outlook through the account of the person it works for, so every reply sits in that person's drafts. When Ada changes a disposition, it mentions Nova with the control IDs, and Nova proposes the tracker update.

The evidence pass, control by control

The evidence policy says which source wins when two disagree. The room guidelines carry the same order, so all three agents weigh evidence the same way.

Auditor notices are inputs, not outcomes

A rejected sample means that sample does not count. It does not mean the control fails, because another valid sample may already be in Box. A denied not-applicable request means the control now needs evidence, not that it is broken. Ada re-derives each control a notice names from all of its sources and shows which source decided the result.

Relocated evidence works the same way. When IT moves mislabeled files to the right folder, nothing is fixed until both the old control and the new one have been re-derived. Closeout adds files and never edits them: Nova writes a new closeout file for each family, and the evidence the auditor already saw stays as it was. Every agent turn keeps a run history, so when the auditor asks why a control moved, the steps are on record.

What the checks catch

• A control with complete evidence whose ClickUp owner differs from the roster, held until the owner is corrected
• A Box file whose name points to one control while its content supports another
• A rejected sample treated as a reason to re-check the control, not as a failed control
• A denied not-applicable request that reopens the control for evidence
• A closeout step that would overwrite an existing Box file, written as a new file instead

What stays with people

• Approving every disposition and every change to the tracker
• Committing to remediation dates, which only the control owner can do
• Sending each reply to the auditor from the audit inbox
• Deciding what goes to the auditor, who alone forms the audit opinion

Integrations in this workflow

Kylon is not a compliance automation tool, it does not replace one, and it does not assess anything on the auditor's behalf. It sits across the tracker, the evidence store and both mailboxes, and keeps the reasoning for every control in the room.

• Box
• ClickUp
• Gmail
• Google Drive
• Outlook
• Slack

• ClickUp holds one item per control with its owner, family, disposition and remediation date
• Box holds the evidence folders and the new closeout file for each control family
• Google Drive keeps the owner roster, the evidence policy and each version of the sample table
• Outlook carries control owners' mail: uploads, explanations and not-applicable requests
• Gmail is the audit inbox, where the auditor's requests and notices arrive and replies leave as drafts a person sends
• Slack is where control owners ask quick questions about a control, and Nova brings each one into that control's thread

Where to start

Choose one control family a few weeks before fieldwork. Connect ClickUp and that family's Box folder, and put one rule in the room guidelines before anything else: no control changes status because of a single notice, and every change is re-derived from all sources and approved by the compliance lead.

“An auditor's notice used to close a question. Now it opens one, and the evidence answers it.”

Set it up with your agent

Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.