Menu
On this page
- How would Scrut hand one control to a SOC 2 auditor?
- Do Scrut’s Okta and OneLogin integrations handle the same lifecycle?
- Can Scrut reviews verify the Audit Center handoff?
- How can you verify Scrut’s identity and Audit Center paths?
- What remains with the CPA when Scrut Audit Center is used?
- How much does the Scrut offer cost?
- When does Scrut’s Audit Center justify a shortlist?
Scrut Automation belongs on a SOC 2 shortlist when the same control evidence will support another framework and your CPA needs a scoped Audit Center project. It is harder to justify for a single, small audit if the identity setup and platform cost exceed the work it removes. Test the auditor handoff and your actual identity provider before signing.
Compare with: our Vanta review for a different integration model, our Drata review for its audit portal, or our Secureframe review for guided implementation.
Pros
- Audit Center supports scoped auditor projects
- SOC 2 and ISO 27001 control reuse
- Okta catalog lists SCIM provisioning
- OneLogin sync has a documented interval
Cons
- Shared mappings need framework-specific checks
- Auditor export needs a live test
- OneLogin setup requests Manage All scope
- Public price covers only organizations up to 20 employees
Scrut Automation is the compliance platform at scrut.io; search results for a Malaysian car-inspection service named Scrut describe a different business. Scrut markets a shared control model and a dedicated Audit Center, but a shared mapping does not show what an invited CPA can actually obtain. The Scrut software profile holds the dated capability record. Where Scrut sits against other platforms is covered in our SOC 2 software guide.
How would Scrut hand one control to a SOC 2 auditor?
Scrut says an Audit Center project can be scoped by framework or specific controls, with role-based auditor access, requests, findings, and evidence pulls. For a buyer running SOC 2 and ISO 27001, the useful test is one control that both programs use: follow its source evidence into a SOC 2 audit project, then have the CPA request a different sample or exception. A common control label alone does not complete either examination.
| Point in the handoff | Scrut's documented path | Decision to prove in a demo |
|---|---|---|
| Control across SOC 2 and ISO 27001 | Scrut describes overlapping controls in its Unified Control Framework. | Show both mapped requirements and a framework-specific gap; name who approves the mapping. |
| Evidence and exception | Connected evidence and manual artifacts can feed controls; findings can link to controls and documents. | Show the original timestamp, a late or failed collection, the owner, and whether each framework sees the exception. |
| Scoped audit project | The buyer can create a project for a framework or selected controls and invite auditors with role-based access. | Have the CPA inspect the intended controls and verify that unrelated material stays outside its view. |
| Request and export | The Audit Center tracks requests, findings, actions, and an audit log. | Have the CPA request a fresh sample, reopen a finding, and check the export and retained trail. |
Sources: Scrut's Audit Center page and Unified Control Framework description, read September 25, 2026, plus the dated Scrut record. These are vendor-described capabilities and buyer proof requests, not a tested CPA session. Public material does not establish the export format or retention in a buyer's contracted edition.
Scrut’s general FAQ says automated tests run daily against configured controls. That published cadence does not prove every connected source refreshes daily or that an auditor receives an artifact with the observation-period history it needs. Ask for timestamps and a failed-source recovery example.
Do Scrut’s Okta and OneLogin integrations handle the same lifecycle?
No. Okta’s Scrut Automation catalog entry, updated August 20, 2025, lists SAML, SCIM, and create, update, and deactivate provisioning functions. It does not establish which Scrut edition includes them or how your tenant is configured.
Scrut’s OneLogin instructions describe SSO plus employee and access-data sync every 24 hours, with a manual sync option. Scrut says a user removed from OneLogin loses SSO access; Scrut’s People record changes to “offboarding needed” after the next sync. For automated OIDC application setup, the instructions require a OneLogin API credential with Manage All scope. Scrut says it uses that scope to configure the SSO app and fetch data, not to modify IdP users or roles. Ask security to review that scope and ask whether a narrower manual setup is supported for your deployment.
Neither document proves what happens to a control owner, assigned task, or auditor account after a role change. Test those cases in the identity provider you actually use, and keep the sync log and timestamps. Do not treat the OneLogin employee sync as Okta SCIM provisioning.
Can Scrut reviews verify the Audit Center handoff?
Public Scrut ratings and excerpts can suggest questions for an auditor demo, but they cannot verify the CPA handoff in your proposed edition.
Gartner Peer Insights showed Scrut at 3.8 out of 5 from six ratings on September 25, 2026. One visible August 21, 2025 review describes evidence collection and linking controls to risks; another visible title criticizes basic cybersecurity features. Gartner’s page currently shows placeholder text in some top-page excerpts while also exposing at least one substantive review body farther down. Six ratings cannot establish how often either experience occurs, and this is not a SOC2Auditors.org score.
The AWS Marketplace reviews include entries attributed to G2. Visible June 2026 entries discuss evidence gathering, integrations, and support; others ask for stronger reporting, customization, or access and asset records. Use those issues as demo prompts. The visible Marketplace subset does not establish a G2-wide pattern. Employer reviews and the unrelated car-inspection results do not measure this product.
How can you verify Scrut’s identity and Audit Center paths?
Use one real control and your intended CPA. Keep the named artifacts from each step:
- Cross-framework mapping: Map the control to SOC 2 and ISO 27001. Capture both requirements, the approving owner, and one requirement that remains framework-specific.
- Connected and manual evidence: Attach a connected source and a manual artifact. Keep collection timestamps, source permissions, owner, and retention settings.
- Failed collection: Break or delay the source. Show the alert, assigned remediation, recovery, and historical gap in both framework views.
- Okta lifecycle, if used: Create, update, and deactivate a test person through Okta. Keep the SCIM event and Scrut access state; confirm edition inclusion in the proposal.
- OneLogin lifecycle, if used: Remove a test employee and show immediate SSO denial, the next Scrut sync, and the “offboarding needed” state. Keep the sync log and the approved API permission scope.
- Owner transfer: Change an evidence owner’s role or remove the account. Show who receives the open task and whether auditor access changes.
- Audit Center scope: Create a SOC 2 project and invite the CPA. Have the CPA check visible controls, source artifacts, and an unrelated item that should remain hidden.
- Auditor follow-up: Have the CPA request a new sample, comment on an exception, reopen a finding, and inspect the resulting timestamps and assignments.
- Readiness report and exit: Generate Scrut’s audit-readiness report and export the control, mappings, evidence, requests, and exception trail. Have the CPA assess whether the package is usable outside Scrut; reconcile the tested features with the signed order. The CPA issues the SOC 2 opinion separately.
Run the proof before signing. A successful shared-control demo without the CPA’s sample and export path leaves the main buying question open.
What remains with the CPA when Scrut Audit Center is used?
Scrut’s Audit Center page says invited auditors can access relevant projects, evidence, requests, and findings. The buyer still defines scope, operates controls, resolves failed checks, and supplies complete evidence. The independent CPA decides testing procedures, evaluates exceptions, and issues the SOC 2 opinion; Scrut does not issue it.
Bring the intended firm into the proof of concept. Have it confirm the role permissions, request trail, sample handling, export format, and evidence retention before the observation period. If you still need a firm, use the auditor directory after defining the software workflow.
How much does the Scrut offer cost?
The AWS Marketplace listing showed $15,000 for a 12-month Compliance Automation contract for organizations up to 20 employees on September 25, 2026. This is one scoped public offer, not a general Scrut starting price or a quote for a larger team. Scrut’s directory profile classifies the broader pricing model as quote-only. Request a written proposal covering employee-count changes, entities, frameworks, source integrations, Audit Center users, Okta or OneLogin setup, support, implementation, renewal, and export rights, and put the independent CPA’s examination fee on a separate line. A platform subscription, even one with an Audit Center, does not buy the audit opinion.
When does Scrut’s Audit Center justify a shortlist?
Shortlist Scrut when the shared evidence and scoped auditor handoff in the proof steps reduce actual work in your program. The identity provider and contracted scope can change that decision. If reuse across frameworks is the draw, our Strike Graph review covers another platform that offers reusable controls and cross-framework mappings.
| Buying situation | Shortlist direction | Reason to test |
|---|---|---|
| SOC 2 and ISO 27001 share owners and evidence; the CPA wants a scoped project | Scrut | Follow one reused control through a finding, CPA request, and export, including the framework-specific gap. |
| A single first SOC 2 is the immediate task | Vanta or Secureframe | Compare the work each platform removes and the full quote against Scrut's scoped Marketplace offer. |
| Audit workflow matters, but a different portal or identity setup may fit better | Drata alongside Scrut | Have the same CPA run the request and export in both products; compare role permissions and contracted access. |
These are demonstration choices, not a complete feature or price comparison. The Scrut paths described above are based on vendor documentation and the scoped public offer.
The demonstration should leave you with the CPA’s sample package, identity event timestamps, unresolved framework gaps, and an itemized order that covers the workflow you tested. The SOC 2 software directory lists the other platforms to put through the same test.
More in Compliance Tools