Most compliance controls are written with a multi-person org in mind — someone reviews someone else's code, someone else owns each policy, someone manages physical office access. When you're a solo founder or a 2-3 person team, several controls need a different (but still legitimate) answer rather than a workaround.
Change management without a human peer reviewer
SOC 2 and ISO 27001 both expect some form of independent code review before deploying to production. If you're the only engineer, a second human reviewer genuinely isn't available — auditors generally accept an alternative control instead of a human, most commonly:
An AI code-review tool (e.g. an LLM-based review gate) required before merge, paired with
Branch protection enforced on your main branch so nothing merges without that check passing
See Managing Code Repositories for how branch protection rules work in ComplyJet. Document why you're using this alternative (team size, tooling used) — auditors want to see it was a deliberate control, not an oversight.
Background checks on yourself
If you have no other employees, you still need a background-check record for yourself under most frameworks — but "who runs a background check on the sole owner" is a fair question. In practice:
Run a standard background-check service on yourself the same way you would for any hire, and upload the result as evidence.
If you genuinely can't (e.g. certain jurisdictions), use Change Requirement on your own People record to mark it not required with a reason — see Managing Your People Roster.
Policies that assume a bigger org
Some policy templates — physical access control, for a fully remote company with no office, is the most common example — don't apply to your actual setup. Rather than deleting them or leaving them incomplete:
Mark the policy Excluded rather than trying to force-fit content that doesn't describe your real environment. The Policies page has an Excluded tab alongside All / Draft / Needs Approval, exactly for this.
For policies that do apply but where one person holds every role (CEO, CTO, Security Officer, etc. all being you), it's fine for a policy to name a title rather than a person, and for that title to be held by the same individual across multiple policies — auditors expect this at your size.
Documents and org structure
Org charts, job descriptions, offboarding checklists — these are still requested even at 1 person. Where a document genuinely doesn't apply (there's no one to offboard, no org chart beyond "just me"), a short explicit note saying so is generally accepted evidence in itself; don't leave the item blank with no explanation.
When in doubt, ask before the audit, not during it
None of the above is a workaround to hide from your auditor — it's the legitimate small-team answer to a control written for a bigger org, and auditors who work with early-stage startups see this constantly. If you're unsure whether your approach to a specific control will hold up, it's much cheaper to check with your auditor or with ComplyJet support before the audit starts than to find out during evidence review.