What auditors actually ask for
SOC 2 (CC1 and CC2), HIPAA (§164.530(b) training and §164.316 documentation) and ISO 27001 (A.5.1, A.6.3) all expect evidence that employees were made aware of, and acknowledged, the policies that apply to them. In practice the auditor samples a few employees and a few policies and asks for:
- The policy as it existed at the time (a version, ideally with a hash or revision id).
- Who acknowledged it, with a timestamp and the wording they agreed to.
- Proof that new hires acknowledged within their first weeks.
- Proof of periodic (usually annual) re-acknowledgment.
- A list of who has not acknowledged, and what you did about it.
Acknowledgment collected inside chat is accepted; compliance platforms such as Sprinto and Vanta run policy acknowledgment inside Slack for exactly this purpose. The point is the record, not the medium.
SOC 2 policy acknowledgment evidence
With ReadStamp the evidence for a SOC 2 audit is one PDF per policy. It carries the company name, the policy title, the version number and SHA-256 content hash, a snapshot of the content, the acknowledgment log (person, email, Zoom id, confirmation wording, UTC timestamp, version), the pending list, and a report hash so a second export can be compared with the first. Acknowledgment rows are append-only; a void is logged, never deleted.
For the "new hires" and "annual" questions: new members of the account automatically receive open required policies, and an announcement can be marked recurring so every recipient must re-acknowledge every 12 months.
HIPAA policy attestation for small practices
A dental or medical group on Zoom Workplace typically needs staff to attest to the privacy policy, the security awareness training and the sanctions policy, once at hire and annually after. Email chasing does not scale across sites, and a Google Form is one more login.
- Post each policy from the dashboard composer with confirmation type I have read and agree, the policy PDF or Google Doc as the document link, a due date two weeks out, and Recurring every 12 months.
- Turn on Require opening the document before acknowledging, so the audit log shows both the open and the acknowledgment time.
- Let the reminders run: the day before, on the day, every two days after. Office managers get the overdue list automatically.
- Before the audit, export the PDF for each policy. Done.
Audit evidence checklist for policies
- Every policy has an owner, a version and a date.
- Every employee in scope acknowledged the current version, with a timestamp.
- New hires acknowledged within 30 days of their start date.
- Material changes triggered re-acknowledgment; minor edits are recorded as versions.
- Annual re-acknowledgment is scheduled, not remembered.
- The pending list is reviewed and chased; exceptions are documented.
- Exports are kept with the audit evidence for the period.