SOC 2 evidence for offboarding shows whether an entity completed access removal and asset return when employment ended. CertPro tests CC6.2 and CC6.3 by sampling departing employees from an HR list. The auditor compares termination dates with system-generated removal timestamps and return records. SOC 2 sets no fixed deadline, so the entity's written policy establishes the timeframe.
An employee's last day triggers two distinct obligations that SOC 2 auditors evaluate independently: removing logical access from every in-scope system, and asset return or sanitizing the physical and virtual asset the employee held. Organizations frequently close the access ticket and consider the matter resolved. Auditors do not. The laptop sitting in a home office, the API token still assigned to a former contractor's email, and the shared password no one rotated are each a testable control gap.
The auditor follows a departing employee from the termination date through the final access and equipment records. The central question is straightforward: Can management demonstrate who completed each action, when it occurred, and whether it met the entity's policy? The following sections explain how auditors select departing employees, examine supporting records, and evaluate exceptions.
Concern
Management often treats offboarding as complete once IT disables an account and collects a laptop. However, the auditor examines dated records across HR, IT, and asset management. A sampled leaver with mismatched dates, no named actor, or missing asset return documentation may produce an exception under CC6.2 or CC6.3.
Overview
CC6.2 addresses the removal of credentials when access ends. CC6.3 addresses access authorization based on an individual's role and responsibilities. SOC 2 sets no fixed removal deadline. The auditor measures timing against the entity's policy. Type 1 examines control design and implementation at a specified date. Type 2 tests operating effectiveness across the examination period.
Solution
The auditor requests the HR leaver list, evaluates its completeness, and selects a sample. For each leaver, the auditor compares the termination date, access removal timestamp, and asset return record against the entity's policy. System logs that identify the date, time, and responsible actor provide relevant evidence for each test.
What the Examination Tests Under CC6.2 and CC6.3
Asset return is not a single step; it is a chain of evidence. The chain starts with an HR-system termination record and ends with a confirmed wipe or destruction notice tied to a device serial number. Everything in between is what an independent auditor samples to determine whether the control operated as designed, consistently, over months.
What CC6.2 and CC6.3 Require for Access Removal
The auditor examines whether the entity removes logical access when an individual's authorization ends or changes.
CC6.2 addresses the management of system credentials and access authorization. The auditor examines whether the entity revokes credentials when an individual no longer requires access.
CC6.3 addresses authorization based on job responsibilities and system access requirements. Role changes, transfers, and termination events can affect these authorizations.
For a departing employee, the auditor examines whether the entity completed access removal across relevant systems. These may include cloud platforms, business applications, privileged accounts, VPN services, and identity providers.
The list below summarizes the mapping auditors use most often when scoping offboarding evidence requests.
SOC 2 TSC Mapping for Offboarding Controls
-
Logical access removal
SOC 2 TSC: CC6.2, CC6.3
-
Physical asset return
SOC 2 TSC: CC6.5
-
Credential and key rotation
SOC 2 TSC: CC6.5
-
Media sanitization / wipe
SOC 2 TSC: CC6.5
-
Device inventory reconciliation
SOC 2 TSC: CC6.1
Why the Entity's Policy Determines the Removal Deadline
The AICPA Trust Services Criteria do not prescribe a universal number of hours or days for access removal. Instead, the auditor evaluates the entity's control activities against its stated requirements.
For example, an entity may require IT to disable access by an employee's final working day. The auditor compares that requirement with the actual system log timestamp.
A policy without a defined timeframe gives the auditor limited criteria for evaluating timeliness. A difference between the policy and actual practice may produce an exception.
Type 1 examinations evaluate control design and implementation at a specified date. Type 2 examinations evaluate operating effectiveness throughout the examination period. When no employee leaves during a Type 2 period, the auditor examines HR records and makes inquiries to assess whether the population contains any qualifying events.
How the Auditor Builds the Leaver List for SOC 2 Evidence Collection
Starting With the HR Termination List
The auditor generally begins with the HR termination register or another authoritative record of employment and contractor exits.
This approach gives the auditor a population that originates outside the IT access removal process. The auditor compares HR records with relevant identity management records, contractor registers, and asset inventories.
For example, an HR termination record may identify an employee's final working day, while the identity platform records the account deactivation timestamp. These records help the auditor trace one termination event across different functions.
The auditor also considers contractors and other personnel who may hold access to the entity's system.
Testing Completeness and Selecting the Sample
A sample supports the examination only when the underlying population represents the relevant termination events.
The auditor compares the HR list with other available records to identify omissions or inconsistencies. The auditor then selects samples using professional judgment. The AICPA does not prescribe one universal sample size for every SOC 2 examination.
The sample may include voluntary exits, involuntary exits, contractors, and remote employees, depending on the population and examination scope.
The auditor may use inquiry, inspection, or observation as appropriate. Management explanations provide context, while supporting records demonstrate the actual control activity. This distinction matters during SOC 2 evidence collection.
Which Records Decide Access Removal and Asset Return
Records the Auditor May Inspect for Each Sampled Leaver
For each sampled termination, the auditor may examine connected records, including the following:
- HR termination record: The employee's termination date and effective date.
- Access removal timestamp: The date and time of account deactivation from the relevant system log.
- Named actor: The identity of the individual or authorized service account that performed the removal.
- Asset return receipt: A dated receipt matched to the device serial number.
- Wipe or lock confirmation: A system record showing the outcome of the relevant device security action.
These records help the auditor establish a traceable sequence. SOC 2 evidence gains relevance when each record identifies the correct individual, system, action, and date.
Resolving Conflicting Dates and Asset Records
The auditor compares timestamps across HR records, IT tickets, identity platforms, and asset inventories.
For example, an IT ticket may show Monday as the closure date, while the identity platform records account deactivation on Wednesday. The auditor examines the underlying event timestamp rather than relying solely on the ticket closure date. Time zone differences and administrative delays may explain discrepancies.
Asset return also requires a clear connection between the departing employee and the returned device. The auditor examines the serial number, dated receipt, and inventory status change. These records establish whether the entity received the correct equipment.
SOC 2 does not prescribe a specific device sanitization method. The auditor evaluates the entity's stated policy and examines relevant wipe or lock records.
For remote employees, a wipe command alone shows that an administrator initiated an action. A confirmation log provides evidence of the outcome. If a device remains offline, the auditor examines the last known device state, follow-up records, and any related incident documentation.
How Late or Undocumented Removal Reaches the Report
From a Test Result to an Exception
An exception occurs when a tested control activity fails to meet the applicable criterion or the entity's stated control requirement.
For example, the entity may require access removal by an employee's final working day. If the identity platform records deactivation two days later, the auditor evaluates the difference against the control description and supporting evidence.
Missing timestamps, incomplete removal records, and unmatched device receipts may also indicate exceptions.
The auditor documents the relevant sample, expected control activity, actual result, and supporting evidence. Management explanations may help clarify the circumstances, but the auditor evaluates those explanations against available records.
How the Auditor Evaluates the Extent and Reporting Impact
One late removal event may have a different significance from repeated delays across multiple samples. The auditor evaluates the nature, cause, frequency, and potential effect of each exception.
The auditor may also inspect authentication logs to determine whether anyone used the departing employee's account after the termination date. Such activity can provide additional context about the extent of the exception.
An exception does not automatically change the SOC 2 opinion. The auditor evaluates the exception in relation to the applicable Trust Services Criteria and the examination as a whole.
Management may provide a response in the SOC 2 report. Buyers can then review the exception, its extent, and management's explanation when assessing the entity's control environment.
Conclusion
Effective offboarding requires traceable records that connect termination dates, access removal, responsible actors, and equipment disposition. The auditor evaluates whether those records support the entity's stated controls and applicable Trust Services Criteria.
CertPro is an independent, licensed CPA firm that conducts SOC 2 examinations through inquiry, inspection, and observation. We independently evaluate control design and operating effectiveness and issue the SOC 2 opinion. Our role focuses on the evidence, including records that demonstrate access removal and asset return.
Organizations preparing for a SOC 2 examination can schedule a meeting with CertPro's auditors to confirm the system scope, evidence requirements, and examination period.
