Rakenne vs ChatGPT for SOC 2 Control Narratives

An ordinary chat prompt can help a knowledgeable team put words on a page. It does not, by itself, supply a shared SOC 2 drafting sequence, evidence placeholders, or a deterministic check of the text it produces. This page makes that distinction concrete without treating either tool as an auditor.

We use the same fixed, fictional Northstar Relay scenario for both approaches. The examples are synthetic and deliberately limited to a first pass for CC6, CC7, and CC8. They are not customer output, a benchmark of all ChatGPT configurations, or evidence that a document will pass an audit.

The same drafting brief

Northstar Relay is a fictional 70-person SaaS company that uses Okta, AWS, GitHub, and Datadog. Its team wants first-draft Security narratives for CC6, CC7, and CC8, using only a defined set of policies, runbooks, and evidence artifacts.

The brief requires the drafter to state what happens, how it happens, who is responsible, and the frequency where known; attach a named evidence placeholder; avoid invented facts; and identify questions for review.

This is a workflow comparison, not a claim that a model in plain chat cannot produce a detailed draft. An experienced reviewer can add structure and checks manually; the question is where that work is made explicit and repeatable.

What the workflow adds

The Rakenne entries above are verifiable in the checked-in skill instructions and its extension source. They describe what the workflow and checks are designed to do, not a promise that all inputs are complete or correct.

The output difference is traceability, not prose style

Both approaches can produce readable prose. The useful distinction is whether the draft makes its operating detail and evidence needs easy to review.

Synthetic prompt-only illustration — this is intentionally sparse, not an executed ChatGPT transcript:

## CC7

Northstar Relay monitors systems and responds to incidents.

That sentence may be a reasonable starting point, but it leaves the reviewer to ask how incidents are triaged, who owns the work, which operating artifacts support it, and what still needs confirmation.

Synthetic structured illustration — the same fictional facts arranged in the shape the Rakenne skill calls for:

## CC7 — System operations

**Control narrative:** Datadog alerts and user reports are triaged under the
Incident Response Runbook by the security lead. The security lead reviews the
monthly incident summary and records follow-up actions in the incident tracker.

**Evidence placeholder:** Incident Response Runbook; Datadog alert sample;
monthly incident summary; incident-tracker action export.

**Reviewer question:** Confirm the escalation time target and the retention
period for incident records.

The structured illustration still needs factual confirmation and evidence collection. It is more reviewable because it labels the narrative, the proposed evidence, and an unresolved question instead of treating generated text as a final control description.

A finding that an ordinary prompt does not enforce

The fictional fixture includes the sparse CC7 excerpt above. When the checked-in check_trust_services_criteria_coverage extension evaluates that exact text, CC7 is present but it finds neither a narrative keyword nor an evidence reference. The tool emits warnings to add a control narrative and an evidence reference or placeholder. The separate reliability check also flags the very short, unspecific CC7 block.

This is not a claim that ChatGPT cannot notice the problem when asked. It is a narrower, testable point: in the plain-chat baseline there is no built-in deterministic Rakenne check that runs that rule. The team must perform an equivalent review themselves or add their own checker.

Where human review remains essential

Rakenne does not certify a SOC 2 program, replace an auditor, or establish that a control operated effectively. A compliance owner should still:

• confirm that every system, role, frequency, and evidence artifact is true for the organization;
• decide the audit scope and interpret the applicable Trust Services Criteria with the audit team;
• collect and assess evidence, including samples and exceptions; and
• approve revisions before relying on a narrative for audit preparation.

Plain chat is a sensible drafting aid when the reviewer already has a reliable structure, complete facts, and a manual review process. The Rakenne workflow is most useful when the team wants that structure, evidence prompting, and repeatable checks available at the point of drafting.

Continue the SOC 2 workflow

Use the SOC 2 control narrative template for a template-first route, read the SOC 2 readiness documentation guide for a fuller walkthrough, or review the SOC 2 Control Narrative Author skill and its validation scope.

Try the SOC 2 control narrative workflow

For the medical-device version of this comparison, see Rakenne vs ChatGPT for an ISO 14971 risk management file .

Methodology, limitations, and review

• Method: Both columns use the same checked-in fictional scenario. Product statements are limited to the current skill instructions, references, and extension code. Output excerpts are synthetic illustrations labelled as such; no performance, accuracy, time, or cost benchmark is claimed.
• Limitations: Results vary with the prompt, model, supplied source material, and reviewer. The generic-chat baseline is one deliberately untooled workflow, not a review of ChatGPT as a product or of all integrations.
• Last reviewed: 2026-07-10. Editorial owner: Ricardo Cabral. Review this page quarterly and after a material skill or validation change.
• Measurement: With analytics consent, the primary CTA records the try_skill_cta_clicked event from the #295 taxonomy with this page path, soc2-control-narrative-author, and comparison_primary placement. Review organic/referral entrances, CTA starts, first-document completions, signups, and assisted conversions after 30 days.