Episode 23: Nobody read the report

In this episode of the Distilled Security Podcast, we break down the Delve scandal—flawed SOC 2 reports, copy-pasted content, and oversight failures that expose deeper issues in compliance-as-a-service. Joined by Matthew J. Schiavone, we examine auditor accountability, quality review gaps, and key differences between SOC 2 and ISO 27001.

We also cover what companies should demand from auditors, the role of automation, and whether this scandal will drive real change in the industry.

Topics Covered

The Delve scandal—leaked reports, copy-pasted audits & pervasive deficienciesThe AICPA peer review process & AC Corp's adverse findingsSOC 2 vs ISO 27001—oversight models, witness audits & accreditationThe incentive structure driving compliance to the bottomCompliance automation — what works, what doesn't & AI's real roleWhat to ask your auditor before signing anythingTrust centers — done right vs. compliance theaterIs SOC 2 dead? What needs to change & who has to change it

Hosts

Justin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocumHosts

Matthew J. Schiavone - (Sikich)

Connect with Us

Website: distilledsecuritypodcast.comX:  @DisSecPodEmail: hello@distilledsecuritypodcast.com