Why compliance programs collapse six months after the audit

Passing an audit feels like the end of something. The evidence is in, the auditor is gone, the certificate or report is on its way. Everyone exhales and goes back to work.

That exhale is where most programs start dying, and for SOC 2 Type II and ISO 27001 the months after the audit are exactly what the next audit measures. If your program only runs when someone is preparing for an auditor, what you have is an annual event.

I've supported companies through SOC 2 and ISO 27001 cycles in fintech and healthcare, and I can usually tell which month of the year it is from the state of their evidence folder.

Month one: the champion leaves

Someone drove the audit. Usually an engineering lead or an operations manager who took it on alongside a full job. Once the report arrives, they return to that job, and nobody formally takes over. The recurring tasks they were carrying were in their head, not on a calendar.

Month two: the urgent vendor

Sales needs a new tool by Friday. It will process customer data. The vendor review procedure says security should assess it first, but nobody remembers where the procedure is. The tool goes live. The vendor inventory now has a hole in it that nobody knows about.

Month three and four: dates pass quietly

The policy review date passes. The quarterly access review gets pushed to after the product launch, then after the next one. Two people who left in month two still have production credentials because offboarding relied on someone remembering to tell IT.

If you've ever said "let's do the access review after the launch" in a planning meeting, you've written month four of this story yourself.

Month five and six: the evidence problem

By month five the evidence folder has four versions of most documents and one of them is called FINAL. When a customer asks for the latest incident response plan in month six, it takes two days to find, and the version found is from before the audit.

The company is still certified. On paper nothing has changed. The certificate, as ever, is the last thing to find out.

Why Type II and ISO make this visible

A SOC 2 Type II report covers an observation period, often six or twelve months, and the auditor samples evidence from across it. A missed quarterly access review in month four is an exception printed in the report your customers read.

ISO 27001 certification bodies return for surveillance audits every year of the three year cycle. They will ask for internal audit results, management review minutes and evidence that controls kept operating. A program that ran for one month a year shows up very quickly.

Building for the months nobody is watching

Give every recurring activity a named owner and a date, in a system that reminds them, not in a document that describes them. Make offboarding trigger access removal automatically where you can. Put vendor onboarding behind a short form that security sees. Keep evidence in one place, collected as the work happens.

Recurring tasks with owners and reminders are the least glamorous thing Steppe does, and the thing clients mention most. Whatever tool you use, judge it in month five, not in the week of the audit.

A compliance program is whatever your company does in the months nobody is checking.