SOC 2 Type I versus Type II for a first regulatory compliance audit The most common finding in a first compliance audit is a policy that exists as a PDF and nothing else. Someone bought a template pack, changed the name in the header, and filed it. The quarterly acces... audits compliance Compliance program employee training regulation Regulatory compliance small business Apr 27, 2023