SOC and ISO assurancefor service organizations
CPA-led SOC 1, SOC 2, ISO 27001 and ISO 42001 engagements for technology and financial service providers, from readiness assessment through to the final report.
- Partner-led engagements
- Scope and fees agreed upfront
- Readiness review first
- Year-round support
Our services
Four engagements, tailored to where you are in the process. Hover or tap a card for details.
One foundation, many frameworks.
The control work behind one report is rarely single-use. Policies, access reviews and evidence built for SOC can carry over to ISO and other frameworks, so the foundation keeps paying off as your requirements grow.
As your needs evolve, we can map your existing controls to other frameworks, point out potential gaps and cut down duplicated work.
How we work
Every engagement starts from your systems and your customers’ requirements, not from a template.
Scoped to your business
We start with what you run and what your customers need to see, then set the boundary and criteria to match.
Clear requirements
You get a written list of what is expected and why, so your team can plan the work.
Minimal disruption
Requests are batched and scheduled around your release cycle and busy periods.
One point of contact
The same people handle your engagement from the first call to the final report.
Your engagement, in one view
A shared workspace shows what has been tested, what is still open and what we need from you. Sample data shown.
About us
A focused CPA practice for organizations that need more than a checkbox.
“Most clients come to us unsure what an auditor will ask for. We make that clear before the audit starts.”
We are a New York CPA practice founded in 2009 to give service organizations a more focused, responsive alternative to large firms. Our team brings audit, security and risk expertise to every engagement, and we tailor each one to your systems, your customers and your timeline.
How we work
- Listen firstWe learn your systems, customers and constraints before proposing anything.
- Scope clearlyStandard, boundary, period and fees are agreed up front.
- Stay accountableOne partner-led team from kickoff to final report, and beyond.
What you can expect from us
What sets our practice apart
Six practical differences you will notice from the first call.
Process
Readiness review and fieldwork follow one plan, so evidence gathered early is reused in the audit.
People
You work with experienced auditors and security reviewers, not a rotating junior team.
Technology
Requests, evidence and status sit in one shared workspace that your team and ours can both see.
Tools
Policy templates and control checklists mean you are not starting from a blank page.
Commitment
The scope and fee are agreed in writing before any work begins.
Pricing
Quotes are based on scope and itemized, so you can see what drives the cost.
Eight steps to compliance
From first conversation to ongoing support, with clear handoffs and no surprises. Timelines are confirmed in scoping.
Intro call
We learn about your systems, customers and goals.
Scoping
Agree the standard, boundary, period and fees.
Readiness review
A focused review of policies and controls against the standard.
Gap remediation
A clear roadmap to close what is missing.
Fieldwork
Walkthroughs, evidence review and testing.
Draft review
You check the draft report before it is final.
Final report
Your SOC report or certification-ready package.
Ongoing support
Year-round guidance and a smooth renewal.
What the examination covers
A SOC 2 report is organized around five trust criteria. We test each one, and we treat governance as the base underneath them.
- SecurityProtection of systems and data against unauthorized access.
- AvailabilitySystems are available as committed to customers.
- Processing integrityProcessing is complete, accurate, timely and authorized.
- ConfidentialityConfidential information is protected as agreed.
- PrivacyPersonal information is handled according to your commitments.
- GovernancePolicies, risk assessment and oversight, the base for ISO 27001 and 42001.
Book a call
Tell us what you need in three quick steps. We reply with a plan, a timeline and a clear scope.
Pick a service
Common questions
New to SOC or ISO? These are the questions we hear most often.
What is the difference between SOC 1 and SOC 2?
SOC 1 covers controls relevant to your customers’ financial reporting. SOC 2 covers how you protect customer data against the Trust Services Criteria. Many providers need one, some need both.
Do you issue ISO 27001 or ISO 42001 certificates?
Certificates are issued by accredited certification bodies. We help you prepare through gap assessment, remediation planning and internal audit support, so you go into the certification audit ready.
What is ISO 42001?
ISO/IEC 42001 is the international standard for an AI management system. It sets requirements for governing how AI is developed, provided and used, including risk management and oversight.
How long does an engagement take?
It depends on the standard and your readiness. A SOC 2 Type I or an ISO gap assessment can take weeks. A Type II needs an observation period of several months. We confirm timelines in scoping.
We are new to this. Where do we start?
Start with a call. We will help you pick the right standard, run a readiness review and map out the steps.