SECURITY Signal 532
Show HN: Ex-Deloitte auditor open-sourced the whole SOC 2 method for your AI
An ex-Deloitte auditor has released the complete SOC 2 methodology for AI as an open-source repository.
Engineers now have a publicly auditable set of controls, evidence mappings, and testing rules instead of relying on undocumented industry practices. The repository shows how a Type II audit can be performed on full data populations, reducing the need for statistical sampling. It also provides calibration examples that reveal a systematic tendency to over-flag compliance issues, which teams must address when building their own audit pipelines.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The repo contains a full control library (86 controls), test attributes (355), criteria mappings (61), and evidence sources (22) in machine-readable JSON.
The methodology defaults to testing every item in the data population, using deterministic rules and a seeded hash algorithm only when sampling is unavoidable.
Calibration examples document 498 AI judgment calls, highlighting a bias toward over-flagging and offering concrete guidance for correcting deviations.
THE CLUSTER