What does a SOC 2 readiness firm do?
A SOC 2 readiness firm reviews your current controls before the audit, identifies gaps, and tells you what to fix before fieldwork starts. The work can be done by a consultancy or CPA firm, but the final report still requires an independent CPA auditor.
Readiness is useful because it finds problems while they are still cheap to fix. Missing access review evidence, informal change approvals, weak vendor reviews, stale policies, and untested incident response plans are easier to address before the Type 2 observation period opens. A good readiness firm gives you a practical remediation plan, not a thick report no one uses.
When should you hire a readiness firm instead of an auditor?
Hire a readiness firm when you know you have gaps, lack internal compliance ownership, or need help turning policies and evidence into an auditable control set. Hire an auditor when controls are operating and you need the Type 1 or Type 2 report.
First-time buyers often contact auditors too early. That can work for a clean Type 1 if the scope is narrow, but it becomes expensive when the auditor spends fieldwork time explaining missing evidence. Use readiness first when the answer to "who owns access reviews, vendor reviews, and change approval evidence?" is unclear.
Can the same firm do readiness and the SOC 2 audit?
The same CPA firm may provide limited readiness feedback and later audit you, but it cannot design, implement, or operate the controls it will test. If the provider helps build your program, use a separate independent CPA firm for attestation.
This is the independence rule that protects the value of the report. A readiness-only consultancy can help write policies, organize evidence, train owners, and manage remediation. The auditor should then test the control environment independently. Ask every provider to document what it will and will not do before the engagement starts.
How should you compare readiness firm quotes?
Compare readiness quotes by deliverable, not just price. A useful quote names the systems in scope, the control set, evidence review depth, remediation support, meeting cadence, and whether the provider will hand off cleanly to an independent auditor.
A cheap gap assessment may be enough if your team can do the remediation. A fuller engagement makes sense when you need policy writing, control-owner coaching, evidence organization, or vCISO support. Before signing, ask for a sample gap report and a clear boundary between readiness work and audit work.
Menu