I've been the internal poc for a soc2 before. The external auditors were all lawyers. As such what mattered was strict compliance with the wording of the standards. With them what we didn't say was nearly as important as what we di