A recent Inc. article highlights an unsettling controversy involving Delve, a Y Combinator-backed compliance startup, and allegations that strike at the heart of how organizations rely on SOC (System and Organization Controls) 2 reports which evaluate an organization’s internal controls over security, availability, and privacy.
According to the report, a whistleblower investigation alleges that Delve generated fraudulent audit reports, fabricated evidence of controls, and created the appearance of compliance for hundreds of customers. Delve has disputed aspects of these claims, and the situation is still unfolding. Regardless of the ultimate outcome, the incident offers an important—and uncomfortable—lesson for organizations that rely on SOC 2 reports as part of vendor due diligence.
Hopefully Not the Norm…
Let’s start with an important point: there is no way to tell how widespread these practices exist in the vendor management space. We suspect the allegations are not the norm. The SOC framework, when properly executed, remains a widely trusted and valuable tool as part of the process for assessing controls.
But “not the norm” is not the same as “impossible,” and there indeed may be critical and material gaps not adequately addressed in SOC 2 reports either by design or inadvertence. When managing cybersecurity risks—particularly where third-party vendors are involved—low probability events can still carry high impact consequences.
What the Allegations Reveal About Systemic Risk
The Delve situation, at its core, is not just about one company. It exposes structural weaknesses in how SOC 2 reports are often consumed:
- Organizations may accept reports without scrutinizing scope or methodology.
- Procurement teams may prioritize speed of certification over rigor and cost, particularly when correlated with a vendor that has a strong reputation or “must know what they are doing!”
- Stakeholders may assume that a SOC 2 report equals real-time security assurance.
So, while organizations may have difficulty assessing a SOC 2 or similar report on its face, there are reasonable steps organizations can and should be taking to probe the representations in such reports. That effort, again, can and should correspond to the risk the vendor presents to the organization, a determination based on several factors, including the nature and volume of the data processed.
Key Questions Organizations Should Be Asking
Organizations need to shift from passive receipt to active evaluation of SOC 2 reports. These reports should trigger questions including:
- What is actually in scope?
Are the systems and services you depend on covered in the report—or carved out? - When did the testing occur?
How stale is the observation period relative to current operations? - What has changed since the report was issued?
New infrastructure, new security team, new vendors, new risks? - How independent was the audit?
Who performed it—and did they have any evident conflicts of interest? - Do the findings make sense?
“Zero incidents” across dozens (or hundreds) of organizations should invite scrutiny, or at least curiosity, not comfort. - What ongoing assurance exists?
Is there continuous monitoring—or just a static document?
These are not theoretical concerns. As some observers have noted, if compliance attestations are flawed, liability may ultimately sit with the organizations that relied on them.
We recently explored many of these themes on our We Get Privacy podcast –
Moving Beyond Checkbox Diligence with SOC Reports – joined by Eric Ratcliffe of 360 Advanced, an auditing firm that performs SOC 2 audits. One of the key takeaways: SOC 2 reports must be interpreted, not simply collected.
In a world of automation and AI-enabled compliance tooling, the temptation is to move faster—to treat certification as a milestone rather than a process. The Delve allegations suggest that mindset can create blind spots.
The ERISA Angle: Fiduciary Duty Still Applies
For ERISA plan fiduciaries, the implications are even more direct. The duty of prudence may require more than obtaining a SOC 2 report. Plan fiduciaries should be evaluating:
- what the report actually covers,
- whether controls align with plan risks,
- gaps and inconsistencies, and
- ongoing monitoring of risks to plan data, not one-time diligence.
Simply collecting a SOC 2 report—without evaluating its substance—may not satisfy that obligation of prudence.
The Bottom Line
SOC 2 reports remain an important tool. But they are just that—a tool.
The Delve incident is a reminder that:
- A SOC 2 report is a point-in-time snapshot, not a guarantee
- Not all reports are created equal
- And most importantly, trust without verification is not risk management
Organizations should not abandon SOC 2 reports—but they should stop treating them as the finish line. Instead, they should be the beginning of a deeper conversation about risk, controls, and accountability.