SOC 2 readiness assessment for companies
A SOC 2 readiness assessment shows you what an auditor is likely to find, before your audit starts. It is run by someone who has done the auditing.
The fee is fixed and agreed before work starts. The work takes about ten weeks. It is for UK technology companies getting ready for a first SOC 2 audit.
In plain words
- SOC 2 report
- An independent report on how your company protects the data it holds for customers. Only a licensed audit firm can issue one.
- Type 1 and Type 2
- A Type 1 report looks at how your controls are designed on one date. A Type 2 report looks at how they worked over a period, usually several months.
- Readiness assessment
- A practice run before the real audit, sometimes called a gap assessment or gap analysis. It shows what an auditor would be likely to accept, what they would be likely to reject and what to fix first. It is advice to your management. It is not a SOC 2 report.
- Control
- One rule or check your company runs, such as reviewing who has access to a system.
Is this for you?
It is for a UK technology company, often a software-as-a-service (SaaS) business, that sells to larger businesses. A customer is now asking you for a SOC 2 report. You may have no audit firm yet. You may have a compliance platform and still not know whether you are ready.
What the readiness assessment shows you
A control-by-control view
For each control you see what an auditor would accept, what they would reject, and why.
What to fix first
You get one ordered list of gaps, with the reason for each, so your team knows what to fix first and why.
An auditor's eye
The assessment follows the steps of a real audit. Your people explain each control, you provide the evidence, and I test samples of it. I spent seven years in technology audit, on the auditor's side, and was a Senior Manager in Digital Audit at a UK Big Four firm.
A fixed fee and a defined timeline
The fee is agreed in writing before work starts. The work takes about ten weeks from the signed engagement letter and the returned planning workbook.
Independence kept
I assess. I do not build or run your controls, so I never assess my own work. You get a straight answer on each control.
A report you can act on
At the end you get a readiness report to management. You go to the audit firm you choose knowing what to expect.
What a compliance platform does not do
A compliance platform collects evidence. It does not decide your scope. It does not write your system description. That is the part of a SOC 2 report where you describe your service and how it is run. It does not test whether a list of records is complete. It does not tell you which exceptions an auditor is likely to raise. An exception is a case where a control did not work as described.
A readiness assessment looks at exactly those things. The two work well together.
How the readiness assessment works, in about ten weeks
A call and a written scope. We talk for about 30 minutes. I then send a one-page scope with the fixed fee.
Agreements first. You sign the engagement letter and a data processing agreement. No evidence is sent before that.
Planning (weeks 1 to 2). The ten weeks start when you return the planning workbook, which covers your company, systems, suppliers and controls. We then hold a kickoff call.
Walkthroughs (weeks 2 to 4). The people who run your controls explain how each one works, in a few one-hour calls.
Evidence (weeks 3 to 7). You get one list of what to provide, and you send it in the way agreed in the engagement letter. Each file is checked. You are told if something is missing or does not show what is needed.
Testing (weeks 5 to 8). Record lists are checked for completeness, samples are chosen and each control is tested. I decide whether each possible gap is a real one, and may ask you questions first.
Report (weeks 9 to 10). You get the readiness report. I walk you through it and answer your questions.
The weeks are a plan, not a promise. They depend on how quickly evidence arrives. The response times for both sides are written into the letter.
What you receive, and what you do not
You get
- A readiness report to management.
- A finding for every control, with the reason.
- An ordered list of what to fix.
- A call to walk through the report.
You do not get
- A SOC 2 report. Only a licensed audit firm can issue one.
- A promise about the result of your audit.
- Someone to build or run your controls.
Questions companies ask
Who can issue a SOC 2 report? Do you?
No. Only a licensed audit firm can issue a SOC 2 report. You get a readiness report to management, which is advice.
We already have a compliance platform. Why this as well?
The platform collects evidence. It does not decide your scope or write your system description. It does not test whether a list is complete or tell you which exceptions an auditor is likely to raise. The assessment covers those points.
How much of our time does it take?
You fill in a planning workbook, join a few one-hour walkthrough calls and upload the evidence. The response times are written into the engagement letter, so both sides know what to expect.
Is AI used on our data?
Yes, to prepare the file. No evidence is processed by AI unless the provider's terms forbid training on your data. The engagement letter and the data processing agreement say where your evidence is kept and when it is deleted. Every conclusion is made by a person.
Can you fix the gaps for us?
I tell you what to fix and in what order. I do not build or run your controls. If I did, I would be assessing my own work, and the assessment would no longer be independent.
How is the fee set?
It is a fixed fee, agreed in writing before work starts. It depends on the size of your company and on which SOC 2 categories are in scope. Security is always in scope; others, such as availability and confidentiality, are optional. You get the fee in a one-page scope after the first call.
Does the assessment mean our audit will go well?
No one can promise an audit result, and I do not. The assessment shows you what an auditor would be likely to find, so you can fix it first. The audit firm reaches its own conclusions.
How long does a SOC 2 readiness assessment take?
About ten weeks from the signed engagement letter and the returned planning workbook. It depends on how quickly evidence arrives.
Contact
Tell me what your company does and who is asking you for a SOC 2 report. I will suggest a time for a 30-minute call.
I read and answer every email myself. There is no form on this site and nothing to sign up for.