# Designing route explanations that survive a SOC 2 audit

*The router's score is one number; the explanation is what a reviewer reads. We walk through how Mission Control composes 'Acme chosen — certified provider, verification pass rate 94%, fast (p95 1200ms)' and why it matters more than the score itself.*

Published 2026-04-04 · 5 min read · routing, audit

## What an SOC 2 reviewer wants to see

Not the score. The reasons. A reviewer asks 'why did your system pick this vendor?' — and 'because score=0.83' is not an answer. 'Because the vendor is certified, has a 94% verification pass rate over the last 30 days, p95 latency is 1.2s vs 4.5s for the cheaper alternative, and the price is competitive ($0.10 vs $0.04 cheaper alternative)' is an answer.

Mission Control composes the explanation from the same inputs the score uses. Every reason corresponds to an input that's tracked, hashable, and reproducible.

## Patterns that work

Always name the chosen vendor. Always enumerate at least 1 alternative considered. Always give exact reasons ("verification pass rate 94%") not adjectives ("high verification"). Always include the cost diff vs cheapest peer. Always include p95 latency. Always say whether the vendor is certified.

The pattern is: list the wins; quantify them; call out the alternative; let the reader cross-check.