SOC 2 help from someone who has done the auditing
I am Hoang Tran, a former Senior Manager in Digital Audit at a UK Big Four firm, with seven years in technology audit. Osianic is my business. It does two things: workpaper preparation for audit firms, and SOC 2 readiness assessments for UK companies.
What Osianic does
For audit firms: workpaper preparation
You send the evidence package for one engagement. You get back a documented workpaper for every control, in your own template and style. Your reviewer reviews, concludes and issues.
For companies: a SOC 2 readiness assessment
See what an auditor is likely to find, before your audit starts. The fee is fixed, the work takes about ten weeks, and you get a clear list of what to fix first.
What is a SOC 2 report?
A SOC 2 report is an independent report on how a company protects the data it holds for its customers. Only a licensed audit firm can issue one.
Osianic does not issue reports. It prepares companies for the audit, and it prepares workpapers for the firms that carry out the audit. A workpaper is the document that records how a control was tested, what evidence was seen and what was concluded.
How the work is done
A person decides
Every judgement is made and logged by a person. I decide every proposed conclusion myself before anything is returned.
AI prepares the paperwork
AI tools sort the evidence and draft the documents. They do not conclude, and they do not send anything. I send every email and every file myself.
Agreements come first
Before any evidence is sent, a contract and a data processing agreement are signed. They say where the evidence is kept, who can see it and when it is deleted.
What Osianic does not do
- Osianic does not issue SOC 2 reports. A licensed audit firm does that.
- Osianic does not build or run a company's controls. That keeps the assessment independent.
- Osianic does not promise an audit result. An honest assessment is worth more than a comfortable one.
About
I spent seven years in technology audit and was a Senior Manager in Digital Audit at a UK Big Four firm. I have planned, tested and reviewed the kind of work this site describes.
Osianic is a one-person business. When you write, you reach me.
Contact
Tell me whether you are an audit firm or a company, and what you need.
I read and answer every email myself. There is no form on this site and nothing to sign up for.