Govern / United Kingdom
SOC 2 readiness
Prepare a service organisation’s scope, controls and evidence for an independent SOC 2 examination.
Last reviewed . Fees in pounds sterling plus VAT.
Does your customer need a SOC 2 report—or something else?
Scope and fee
Agree the work.
Know the boundary.
The written proposal defines the scope, responsibilities, price and delivery timetable.
What shapes your quote
- Scope, complexity and existing evidence
- Required specialist work and access arrangements
- Depth of reporting and any separately agreed follow-up
The requirement in context
Define the requirement before selecting the work.
Confirm the requested report, service boundary, criteria and period with the customer and examining firm. SOC 2 is an assurance reporting engagement, not an ISO certificate. Training a person as a Lead SOC 2 Manager does not produce an organisational SOC 2 report.
Primary references
AICPA: SOC suite of servicesInside the work
Does your customer need a SOC 2 report—or something else?
Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation.
| Work area | Decision to make | Evidence to retain |
|---|---|---|
| Customer request | Confirm the required report and intended recipient. | The actual procurement wording and acceptance conditions. |
| Service boundary | Identify the service, infrastructure, people and dependencies. | A system description aligned to the agreed examination. |
| Operating evidence | Define who retains which records and for what period. | Evidence owners, schedules and remediation tracking. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Evidence.
Ownership.
A practical next step.
Prepare a service organisation’s scope, controls and evidence for an independent SOC 2 examination.
- Customer requirement and reporting-scope review
- System description and control ownership support
- Evidence and readiness-gap review
- Remediation and examination-preparation support
How the work moves forward
From the requirement to a usable result.
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Understand the requirement
Define the product, service, process and relevant external requirement.
Build the record
Assign responsibilities and connect decisions to operating evidence.
Review and improve
Check what is working, address gaps and agree the next review.
A practical starting point
Does your customer need a SOC 2 report—or something else?
Confirm the requested report, service boundary, criteria and period with the customer and examining firm. SOC 2 is an assurance reporting engagement, not an ISO certificate. Training a person as a Lead SOC 2 Manager does not produce an organisational SOC 2 report.
Customer request — Confirm the required report and intended recipient. — The actual procurement wording and acceptance conditions. Service boundary — Identify the service, infrastructure, people and dependencies. — A system description aligned to the agreed examination. Operating evidence — Define who retains which records and for what period. — Evidence owners, schedules and remediation tracking.
Before you commission the work
Your questions.
Clear answers.
Does your customer need a SOC 2 report—or something else?
Confirm the requested report, service boundary, criteria and period with the customer and examining firm. SOC 2 is an assurance reporting engagement, not an ISO certificate. Training a person as a Lead SOC 2 Manager does not produce an organisational SOC 2 report.
What is included in the engagement?
Customer requirement and reporting-scope review; System description and control ownership support; Evidence and readiness-gap review; Remediation and examination-preparation support. The proposal defines the exact outputs and acceptance criteria.
What is not automatically included?
Aegentra readiness work does not issue a SOC 2 report. The independent examining CPA firm, its fees, opinion and reliance decisions are separate.
What does the service cost?
UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables.
How should we share evidence?
Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form.
Do you issue a SOC 2 certificate?
No. SOC 2 is an independent CPA attestation engagement and report, not an ISO certificate. Aegentra’s service is scoped readiness support. Agree the required report type, system boundary and customer expectations with the independent CPA firm.
Can a compliance platform replace a SOC 2 examination?
No. It can help organise evidence and workflows, but the independent service auditor evaluates the examination evidence. Dashboard completion and integration coverage do not establish that every relevant control operated over the reporting period.
What should we prepare for a scoping conversation?
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
Resources for this decision.
SOC 2 Type 1 vs Type 2: a UK buyer’s guideLet’s define the work you actually need.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project