SOC 2 PI1.1: processing specifications, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For PI1.1, the usual records are these.

• Product or API documentation that defines inputs and outputs
• Data dictionaries or schemas
• Customer facing service specifications

What Polara asks about it

The free readiness assessment asks 2 questions that bear on PI1.1. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Have you documented what your processing accepts, what it does and what it delivers when, and given that to customers? If yes, show it: product documentation describing inputs, processing and output timing, an API reference with validation rules, or a service description in the customer contract. If no, the fix: document what your processing accepts, what it does and what it delivers when, and publish it to customers in product documentation or the contract.

It also asks, for context:

• What processing does your service perform that customers rely on being complete and accurate?

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Processing Integrity Policy covers PI1.1.

Is it in your scope?

Only if you add Processing Integrity. Whether the system processes data completely, accurately and on time. Inputs, processing, outputs and stored records. It fits a product whose customers depend on its calculations or transactions being right.

The scoping tool decides it with one question: Add it when customers rely on your processing being complete and accurate, such as payments, payroll, invoices or calculations they act on. Defined inputs, completeness and accuracy checks, error handling, output delivery and the records that trace a result to its source.

Security is the default and always in scope. Adding Processing Integrity in the assessment puts its 5 criteria into the report and the examination, and adds 7 questions to the assessment.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Processing integrity: the criteria around it

PI1.1 is one of 5 criteria in processing integrity, PI1.1 to PI1.5. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• PI1.1, this page
• PI1.2, input controls
• PI1.3, processing controls
• PI1.4, output controls
• PI1.5, stored data integrity

Before it: C1.2, confidential data disposal. After it: PI1.2, input controls. All the criteria, Security first, are on the Trust Services Criteria page, grouped by category.