---
title: "SOC 2 Evidence Collection Workflow With AI Agents | Kylon"
description: "How a compliance team prepares SOC 2 evidence: controls tracked in ClickUp, evidence in Box, owners matched to the roster and every auditor reply sent by a person."
url: "https://kylon.io/use-cases/soc-2-evidence-collection"
language: "en"
---
[HOME](https://kylon.io/)\>[Use Cases](https://kylon.io/use-cases)\>SOC 2 Evidence Collection: Controls With Owners and Evidence the Auditor Can Trace
Use Case8 min read
# SOC 2 Evidence Collection: Controls With Owners and Evidence the Auditor Can Trace
Control dispositions, owner checks, remediation dates, mislabeled evidence and auditor notices run through one Kylon room before SOC 2 fieldwork. Agents work the ClickUp tracker and the Box evidence, and the compliance lead approves every change.
[Get started](https://app.kylon.io/sign-up)
Kylon TeamProduct
November 6, 2026
## Sixty controls, evidence in four places, and an auditor who reads every label
Before fieldwork, every control in scope needs an owner, evidence that covers the auditor's samples, and a status the compliance lead can stand behind. Each control is an item in ClickUp, grouped by family. The evidence sits in Box, one folder per family. Control owners explain gaps and ask for not-applicable treatment by Outlook, and the owner roster and the auditor's sample table live in Google Drive.
Evidence collection breaks in the details. A screenshot filed under the wrong control makes one control look ready and another look empty. A control has complete evidence, but the owner on the tracker left the team, so nobody can answer for it. An auditor rejects one sample and the control is marked failed, when the right next step was to check whether a valid sample is already in Box.
## Who works in the room
People
- Compliance program lead
Owns the evidence tracker, approves every disposition and decides what goes to the auditor at closeout
- Control owners
Upload evidence, explain gaps and commit to remediation dates
- Audit liaison
Handles the auditor's requests and notices and sends every reply from the audit inbox
Agents
- AdaEvidence reviewer
Reads the Box evidence for each control against the sample table and the owner's mail, and proposes a disposition with its sources
BoxGoogle DriveOutlook
- NovaTracker keeper
Matches each control's ClickUp owner to the roster, schedules remediation, fixes the tracker and writes the closeout files once approved
ClickUpGoogle DriveBox[Slack](https://kylon.io/integrations/slack)
- FinAudit correspondence
Drafts replies to the auditor and follow-up notes to control owners for a person to send
[Gmail](https://kylon.io/integrations/gmail)Outlook
Ada is the default agent for the audit period, so an unaddressed question about a control's evidence goes to it. Tracker changes go to Nova, which writes to ClickUp under a lasting grant from the compliance lead once each change is approved. Fin drafts in Gmail and Outlook through the account of the person it works for, so every reply sits in that person's drafts. When Ada changes a disposition, it mentions Nova with the control IDs, and Nova proposes the tracker update.
## The evidence pass, control by control
The evidence policy says which source wins when two disagree. The room guidelines carry the same order, so all three agents weigh evidence the same way.
```mermaid
flowchart TD
start([Each control is a ClickUp item,
its evidence in Box])
disp["Ada proposes a disposition from
all sources, with each one cited"]
ok1["Compliance lead approves
before ClickUp changes"]
owner["Nova matches each owner to the
roster, a mismatch holds the control"]
dates["Nova proposes a remediation
date for each gap"]
name["Compliance lead names the right owner"]
commit["Control owner commits to the date"]
fixes["Nova finds wrong families, stale
statuses and duplicate items"]
okfix["Compliance lead approves each fix"]
notice([A relabeling notice or a revised
sample table arrives])
rederive["Ada re-derives each control the
notice names, from all sources"]
reply["Fin drafts replies on the notice thread"]
liaison["Audit liaison sends the replies"]
close["Nova writes one new closeout file
per family, editing nothing"]
decide["Compliance lead decides what
goes to the auditor"]
start --> disp --> ok1 --> owner & dates
owner --> name
dates --> commit
name & commit --> fixes --> okfix --> rederive
notice --> rederive
rederive --> reply --> liaison --> close --> decide
class disp,owner,dates,fixes,rederive,reply,close agent
class ok1,name,commit,okfix,liaison,decide person
class start,notice event
classDef agent fill:#FFFFFF,stroke:#DCD3C8,color:#1B1712
classDef person fill:#EEF0E3,stroke:#6E7447,color:#1B1712
classDef event fill:#F4ECDD,stroke:#F4ECDD,color:#564C42
```
| Stage | What happens | Who acts | Who decides |
| --- | --- | --- | --- |
| First disposition | Each control gets a disposition from its Box evidence, owner mail, the roster and the sample table, with the sources cited | Ada, reading each family's folder with parallel helpers | The compliance lead approves before ClickUp changes |
| Owner check | Each control's assigned owner in ClickUp is matched to the roster, and a mismatch holds the control even when the evidence is complete | Nova | The compliance lead names the right owner |
| Remediation dates | Each gap gets a proposed remediation date and a follow-up note to its owner | Nova, then Fin for the note | The control owner commits to the date |
| Tracker fixes | Wrong families, stale statuses and duplicate items in ClickUp are corrected | Nova | The compliance lead approves each fix |
| Mislabeled evidence | Files named in a relabeling notice are matched to their real controls, every affected control is re-derived, and replies are drafted on the notice thread | Ada, then Fin | The audit liaison sends the replies |
| Revised samples | The auditor's second sample table is checked against what is in Box, control by control | Ada | The compliance lead confirms the result |
| Closeout | One new closeout file per control family is written to Box, and existing evidence files are left untouched | Nova | The compliance lead decides what goes to the auditor |
Stages of one evidence collection pass. Control IDs, file counts and dates in this example are illustrative.
## Auditor notices are inputs, not outcomes
A rejected sample means that sample does not count. It does not mean the control fails, because another valid sample may already be in Box. A denied not-applicable request means the control now needs evidence, not that it is broken. Ada re-derives each control a notice names from all of its sources and shows which source decided the result.
Relocated evidence works the same way. When IT moves mislabeled files to the right folder, nothing is fixed until both the old control and the new one have been re-derived. Closeout adds files and never edits them: Nova writes a new closeout file for each family, and the evidence the auditor already saw stays as it was. Every agent turn keeps a run history, so when the auditor asks why a control moved, the steps are on record.
## What the checks catch
- A control with complete evidence whose ClickUp owner differs from the roster, held until the owner is corrected
- A Box file whose name points to one control while its content supports another
- A rejected sample treated as a reason to re-check the control, not as a failed control
- A denied not-applicable request that reopens the control for evidence
- A closeout step that would overwrite an existing Box file, written as a new file instead
## What stays with people
- Approving every disposition and every change to the tracker
- Committing to remediation dates, which only the control owner can do
- Sending each reply to the auditor from the audit inbox
- Deciding what goes to the auditor, who alone forms the audit opinion
## Integrations in this workflow
Kylon is not a compliance automation tool, it does not replace one, and it does not assess anything on the auditor's behalf. It sits across the tracker, the evidence store and both mailboxes, and keeps the reasoning for every control in the room.
- Box
- ClickUp
- [Gmail](https://kylon.io/integrations/gmail)
- Google Drive
- Outlook
- [Slack](https://kylon.io/integrations/slack)
- **ClickUp** holds one item per control with its owner, family, disposition and remediation date
- **Box** holds the evidence folders and the new closeout file for each control family
- **Google Drive** keeps the owner roster, the evidence policy and each version of the sample table
- **Outlook** carries control owners' mail: uploads, explanations and not-applicable requests
- **Gmail** is the audit inbox, where the auditor's requests and notices arrive and replies leave as drafts a person sends
- **Slack** is where control owners ask quick questions about a control, and Nova brings each one into that control's thread
## Where to start
Choose one control family a few weeks before fieldwork. Connect ClickUp and that family's Box folder, and put one rule in the room guidelines before anything else: no control changes status because of a single notice, and every change is re-derived from all sources and approved by the compliance lead.
> “An auditor's notice used to close a question. Now it opens one, and the evidence answers it.”
## Set it up with your agent
Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.
Set-up prompt
Set up our SOC 2 evidence collection desk in this Room. Take it one step at a time and wait for my OK before you move on.
1. Connect Box, ClickUp, Gmail, Google Drive, Outlook and Slack. Tell me which ones still need connecting.
2. Ask me who works this desk: the compliance program lead, the control owners and the audit liaison. Help me invite them to this Room.
3. Build an Audit Readiness App with columns Gap, Remediation, Ready and Closed, one record per control. Pull each control's owner, family and current status from ClickUp and match it to the roster in Google Drive.
4. Read the Box evidence for each control against the sample table and owner mail in Outlook. Propose a disposition with sources cited. Flag controls where the ClickUp owner differs from the roster, mislabeled files and any rejected sample that needs re-checking from all sources before a status moves.
5. Draft auditor replies and owner follow-up notes as drafts only. Write closeout files as new Box files, leaving existing files untouched. The compliance program lead approves every disposition and every tracker fix before ClickUp changes. The audit liaison sends every reply from the audit inbox. Only a control owner can commit to a remediation date.
6. Write our evidence policy order and our approval chain into this Room's guideline so every control follows the same steps.
7. After each control family closes cleanly, offer to turn the evidence pass for that family into an Automation.
Before you start, ask me for our rules one at a time.
[Get started](https://app.kylon.io/sign-up)
Your first company harness. Where humans and agents run your business together.
[Get started](https://app.kylon.io/sign-up)
## More Use Cases
[View all](https://kylon.io/use-cases)
[
### Clinical Site Monitoring: A Monthly Visit Plan That Holds Up When Things Change
Site dispositions, monitor assignments, schedule reviews and mid-cycle changes run through one Kylon room. Agents work the Salesforce and Box records, and the desk lead approves every assignment before a visit is booked.
Healthcare & life sciencesScheduling & dispatchCompliance & risk
](https://kylon.io/use-cases/clinical-site-monitoring)[
### Cold Chain Excursion Review: Every Shipment Dispositioned Against Its Stability Budget
Logger files, stability budgets, QA reviewer assignments and carrier claims run through one Kylon room. Agents total the minutes out of range and check the manifest, and the QA lead approves every release and reject before a record changes.
Healthcare & life sciencesCompliance & risk
](https://kylon.io/use-cases/cold-chain-excursions)