Common questions
If yours isn't here, ask it on a scoping call. It's free and takes 30 minutes.
Do you issue SOC reports or ISO certificates?
No. SOC reports are issued by an independent CPA firm, and ISO certificates by an accredited certification body. We prepare you for those audits and support you through them.
That separation is deliberate. An auditor can't audit work it designed, so keeping the roles apart protects the credibility of your report.
How long does audit readiness take?
Most readiness projects take 8 to 20 weeks from scoping to audit-ready. The biggest factor is how many controls you already have in place and documented.
We give you a firmer timeline after the gap assessment.
What is the difference between a SOC 2 Type I and Type II report?
A Type I report looks at whether your controls are designed properly at a single point in time.
A Type II report tests whether those controls actually operated over a period, usually between 3 and 12 months. Most enterprise customers ask for Type II.
Should we get SOC 2 or ISO 27001?
It depends on who is asking. North American customers more often request SOC 2, while international customers and some public sector buyers ask for ISO 27001.
The two overlap heavily, so many organizations build one control set that supports both.
What is ISO 42001, and do we need it?
ISO/IEC 42001 is the international standard for managing AI systems responsibly. It covers AI risk, impact assessment, data quality and oversight.
It is worth considering if you sell products that use AI, or if customers have started asking how you govern AI.
What does SOX controls testing involve?
We test the controls over financial reporting, including IT general controls, application controls and the reports management relies on.
Testing follows the approach your external auditor uses, so they can rely on the results.
Can you work with our existing auditor?
Yes. We coordinate with your CPA firm, certification body or internal audit team, and we often attend audit meetings alongside you.
Do you do penetration testing?
We coordinate penetration testing, PCI DSS and HITRUST work through specialist partners, so they fit into one plan with the rest of your program.
How do you price your work?
We quote each engagement after a free 30-minute scoping call. Readiness and review projects are usually quoted as a fixed fee. Secondments and retainers are billed on agreed rates.