Notes from inside the work
Practical writing for the teams that run third-party risk programs: what the guidance asks for, what sits in the evidence that rarely gets read in full, and what changes when the work happens continuously instead of annually.
All posts
- AI October 1, 2026 5 min read
Why your AI assistant is giving you an incomplete list of SOC 2 exceptions
Drop a SOC 2 Type II into a general-purpose chat tool and you get a confident, clean list of exceptions. It is probably incomplete, and nothing in the answer tells you what was skipped.
By Chris Duden
Read - Evidence September 15, 2026 6 min read
What a SOC 2 report does not tell you
A SOC 2 on file is not the same as a third party assessed. Six things buried in the report that decide whether it actually covers your risk, and why most of them never get read.
Read - Regulatory September 8, 2026 7 min read
Ongoing monitoring is a lifecycle phase, not an annual event
The 2023 interagency guidance treats ongoing monitoring as continuous work running the length of the relationship. Most programs still implement it as a yearly questionnaire. That gap is where findings come from.
Read
Want this applied to your own portfolio?
Tell us where third-party risk management costs your team the most time today, and we’ll show you what continuous evidence looks like against your own third parties.
Get in touch