Policy vs. Reality: SOC 2 policy drift checks
ProA policy that says one thing while your evidence shows another is exactly what an auditor finds. Policy vs. Reality uses AI to run a three-way reconciliation of what your policies promise, what your evidence shows, and what the SOC 2 controls require. When any of them disagree, the gap is flagged and a task is created to close it. You decide how each one is resolved.
Updated
Read the transcript
The policy says quarterly. Your access policy says you review who has access every quarter. Your records show one review, last year. Nobody compares the two until your auditor does. The missed reviews become a finding in your SOC 2 report. Policy vs. Reality checks what your policies promise against your evidence and flags the gap when the two stop matching. It opens a task to close it, and you decide whether to run the missing reviews or update the policy. You close the gap before your audit starts, and your auditor sees a policy and records that agree.
Show me your policy is actually followed
The policy says quarterly
The moment
Your access policy says you review who has access every quarter. Your records show one review, last year.
Without SimpleAudit
Nobody compares the two until your auditor does. The missed reviews become a finding in your SOC 2 report.
With SimpleAudit
Policy vs. Reality checks what your policies promise against your evidence and flags the gap when the two stop matching. It opens a task to close it, and you decide whether to run the missing reviews or update the policy.
The outcome
You close the gap before your audit starts, and your auditor sees a policy and records that agree.
How it works
Keep your records in SimpleAudit
Approve your policies and add evidence to the vault, by upload or through the API from your own agents.
See where they disagree
Three-way reconciliation compares your policies, evidence and controls and flags each disagreement with an explanation.
Close the gap
Each flag comes with a task. Fix the policy or the evidence, or accept the difference, and mark it resolved.
Key capabilities
A three-way check
Your policies, your evidence and the SOC 2 controls are compared against each other, so a gap between any two of them shows up.
Drift is flagged early
When a policy and your proof stop matching, you hear about it when it happens, not in the middle of your audit.
Each gap becomes a task
A flagged gap creates a task linked to the policy, the evidence and the control involved, with an owner and a status, so it gets closed.
You make the call
The AI points out the disagreement. You decide whether to update the policy, add the missing evidence or accept the difference.
Works with the evidence you keep
It reads the evidence in your vault, including files your own AI agents push in through the API, so there is no second place to upload.
Why we built it this way
“Most compliance failures I see are not missing policies. They are policies that quietly stopped matching reality. Reconciliation is the part of SimpleAudit I wanted most: a standing check that tells you the week something drifts, with a task to fix it. Your auditor will compare these three things anyway, so you may as well do it first.”
Joe, Founder
Frequently asked questions
What is policy drift in SOC 2?
Policy drift is when a policy promises one thing and your records show another, such as an access policy that says you review access every quarter while your records show one review, last year. Your auditor compares the two, and a gap between them can become a finding in your SOC 2 report.
How is Policy vs. Reality different from a readiness score?
Your readiness score counts what exists: approved policies, collected evidence, assessed risks and vendors. Policy vs. Reality checks whether what exists agrees with what your policies promise, comparing each policy commitment with your evidence files and records, control by control. A gap it finds does not change your readiness score. It opens a task for you to close.
Ready to try Policy vs. Reality?
Included on Pro. Start a 7-day free trial on Pro to use Policy vs. Reality during your trial. No credit card required.