Sample situation: evidence for the first SOC 2 Type II window was spread across four cloud accounts and three ticketing queues, and the audit started in nine weeks.
-58%
Staff hours spent on evidence requests (hours per audit)
96%
Evidence items collected on schedule (of items due)
0 major
Audit findings raised (findings)
Sample outcome: the observation window closed with no major findings, and the following year's evidence calendar ran on the schedule set during this engagement.
Sample situation: one team carried HIPAA duties for clinical customers and SOC 2 duties for platform customers, with two separate spreadsheets and two audit dates.
-41
Controls maintained in duplicate (controls)
120+
Business associate agreements tracked (agreements)
6 days
Access review cycle time (days, was 21)
Sample outcome: both audits run from the same control register, and access reviews finish in under a week each quarter.
Sample situation: enterprise prospects sent long security questionnaires that took the founding team days each, and deals stalled in review for a quarter.
1 day
Median questionnaire turnaround (business days, was 6)
88%
Security reviews passed without escalation (of reviews)
-70%
Late-stage deals delayed by review (deals per quarter)
Sample outcome: security review stopped being the slow step in enterprise deals, and questionnaire answers now come from published material.
Sample situation: evidence for the first SOC 2 Type II window was spread across four cloud accounts and three ticketing queues, and the audit started in nine weeks.
-58%
Staff hours spent on evidence requests (hours per audit)
96%
Evidence items collected on schedule (of items due)
0 major
Audit findings raised (findings)
Sample outcome: the observation window closed with no major findings, and the following year's evidence calendar ran on the schedule set during this engagement.
Sample situation: one team carried HIPAA duties for clinical customers and SOC 2 duties for platform customers, with two separate spreadsheets and two audit dates.
-41
Controls maintained in duplicate (controls)
120+
Business associate agreements tracked (agreements)
6 days
Access review cycle time (days, was 21)
Sample outcome: both audits run from the same control register, and access reviews finish in under a week each quarter.
Sample situation: enterprise prospects sent long security questionnaires that took the founding team days each, and deals stalled in review for a quarter.
1 day
Median questionnaire turnaround (business days, was 6)
88%
Security reviews passed without escalation (of reviews)
-70%
Late-stage deals delayed by review (deals per quarter)
Sample outcome: security review stopped being the slow step in enterprise deals, and questionnaire answers now come from published material.