Home / Services / Our Process

Our process

How an Audit Works With Us

Organized, predictable, and minimally disruptive. You always know what is next, what we need from you, and when your report will arrive.

Request a Consultation Talk to a Partner
Engagement roadmapClear steps. Confident outcomes.
01
Before fieldworkAlign. Prepare. Plan.
  1. Scope
  2. Prepare
  3. Plan
02
FieldworkMeet. Understand. Test.
  1. Meet
  2. Walkthrough
  3. Test
03
ReportingWrite. Review. Deliver.
  1. Write up
  2. Report
04
Ongoing SupportAnswer. Plan. Renew.
  1. Support
  2. Renew

Four phases, ten steps

A clear path from start to finish.

Our approach is designed to be efficient and minimally invasive, with regular communication throughout the engagement.

Before fieldwork

Set the foundation for an efficient audit.

  1. 1.1

    Scope

    Confirm systems, services, and criteria

    During joint discussions with management, we determine which people, processes, and technologies relate to the services you provide to your customers. For a first SOC 1 or SOC 2, you can start with a readiness assessment: a dry run that ends in a management letter listing any gaps to address before the first report.

    Your team: Describe your services and systems

  2. 1.2

    Prepare

    Issue the request list and RCM

    After we receive the signed agreement, we send an initial request list and an illustrative Risk and Controls Matrix (RCM).

    Your team: Sign the agreement and gather documents

  3. 1.3

    Plan

    Set the interview schedule

    We plan the interview schedule for fieldwork around your team's calendar.

    Your team: Confirm interview availability

Fieldwork

Understand your environment and test your controls.

  1. 2.1

    Meet

    Kick off and begin interviews

    We meet with your team and begin the scheduled fieldwork interviews. Most meetings are held by video, with onsite visits when the engagement calls for it.

    Your team: Join the kickoff and introductions

  2. 2.2

    Walkthrough

    Understand processes and controls

    We conduct interviews and walkthroughs of your processes and controls, and obtain documentary evidence to support our audit procedures.

    Your team: Walk us through your processes

  3. 2.3

    Test

    Test design and operating effectiveness

    We evaluate the design of key controls and, for Type 2 reports, test their operating effectiveness and gather sufficient evidence for our opinion.

    Your team: Provide samples and answer questions

Reporting

Communicate results and deliver your report.

  1. 3.1

    Write up

    Draft the description and results

    We write up the description of your services and the testing performed, and review the draft with management.

    Your team: Review the draft report

  2. 3.2

    Report

    Issue the final report

    We discuss the results with management and issue the final report, along with a formal management communication.

    Your team: Receive and share your report

Ongoing Support

Stay covered between reports.

  1. 4.1

    Support

    Answer questions about your report

    After the report is issued, your partner stays available to answer questions about it from your team, your customers, and their auditors.

    Your team: Share the report and send us questions

  2. 4.2

    Renew

    Plan the next report period

    For annual reports, we schedule the next examination period with you so there is no gap in coverage, and we carry forward what we learned about your environment.

    Your team: Confirm the next report period

Partner involvement

Partners stay involved throughout.

A partner is involved at every stage, from scoping through the final report. You work with experienced auditors who know your environment.

  1. Scope
  2. Prepare
  3. Plan
  4. Meet
  5. Walkthrough
  6. Test
  7. Write up
  8. Report
  9. Support
  10. Renew
Partner involvement throughout the audit

What you will receive

Clear deliverables. No surprises.

Practical, high-quality deliverables designed to meet your needs and those of your stakeholders.

Engagement letter and timeline

Clear scope, timing, and expectations from the start.

Request list

One organized list of the information and documents we need from your team.

Risk and controls matrix

An illustrative RCM tailored to your systems and the applicable criteria.

Final report

An independent report you can share with your customers and their auditors, with a formal management communication.

Communication you can count on

Regular touchpoints. Real progress.

We keep you informed throughout the engagement, so there are no surprises.

Kickoff meeting

Align on scope, timeline, the interview schedule, and who to contact.

Regular status updates

Progress, open requests, and next steps throughout the audit, so nothing waits until the end.

Closing meeting

Review the results with management and answer questions before the report is issued.

Frequently asked questions

Common questions, straight answers.

Don't see your question? Contact us and a partner will answer it.

Which audits follow this process?

The engagement roadmap is followed for SOC 1 and SOC 2 examinations. Our HIPAA, HITRUST, FedRAMP, ISO, and other engagements follow a similar structure, adjusted to the requirements of each framework.

Do you offer readiness assessments?

Yes, for SOC 1 and SOC 2. A readiness assessment is a dry run of the examination before your first audit. Instead of a SOC report, you receive a management letter that lists any gaps we identify, so your team can address them before the audit period or report date. Your team remains responsible for designing and fixing its controls.

How long does an audit take?

It depends on the scope of the examination, the number of systems and locations in scope, how ready your documentation is, and whether it is your first audit or a renewal. A partner sets the plan with you at the start, working back from the date you need the report.

How is the timing set?

We work backwards from the date you need the report in hand to share with your customers. That date almost always drives the timing of our work.

What do we need from our team?

The documents on the request list, people available for the scheduled interviews, and walkthroughs, and the samples we select during testing.

Is fieldwork remote or onsite?

Most meetings and walkthroughs are held by video. We come onsite when the engagement calls for it, for example to observe physical security controls.

How disruptive is the process?

We keep it minimal. Interviews are scheduled in advance, requests come in one organized list, and we communicate throughout the audit instead of sending requests for corrections at the end.

What is the difference between Type 1 and Type 2?

A Type 1 report covers the design of controls at a point in time. A Type 2 report also covers whether the controls operated effectively over a period, usually 6 to 12 months.

What happens if you identify an exception?

We tell management as soon as we identify a potential exception rather than waiting until the end, so your team understands it and can provide any additional information. How exceptions are reported depends on the framework and is described in the report.

Do your auditors need access to our systems or install an evidence collector?

No. We don't install evidence collectors, connect tools to your environment, or ask for accounts in your systems. Your team uploads the items on the request list, and we review the evidence there. During walkthroughs, your team shows us your processes and controls on screen.

Let's get started

Talk to a partner, not a sales team.

Get a candid conversation about your needs, timeline, and how we can help.

Request a Consultation Talk to a Partner