Hael provides SOC 2 compliance consulting for technology and service businesses, managing the programme from scoping and readiness assessment through control implementation, evidence collection, project management and independent CPA audit coordination. We support organisations across the United States, the United Kingdom and Europe.
A SOC 2 report is the outcome of an independent examination against the AICPA Trust Services Criteria. It is not a certificate, and it is not awarded for owning a policy set. It reflects whether the controls you describe were suitably designed and, for a Type II, whether they operated across a defined period. Our work is to make that true and evidenced before an examiner tests it.
WHAT WE DO
A tested view of where the control environment stands against the criteria you intend to report against, what is missing, what is weak in operation and what has no evidence behind it. You receive a prioritised remediation plan with owners, effort and a realistic report date.
We define the systems, services, locations and sub-service organisations in scope, and which of security, availability, confidentiality, processing integrity and privacy you should report against. Scope decided badly is the most expensive mistake in a SOC 2 programme.
We implement the controls themselves: access administration, authentication, change management, logging and monitoring, vulnerability management, incident response, backup and recovery, vendor oversight and risk assessment. Designed around how your teams actually work.
The policy set an examiner will read, written for your organisation rather than lifted from a template library, with named owners, review cycles and approval records that match what the controls do in practice.
We establish what evidence each control produces, where it lives, who produces it and on what cadence, then assemble the population and samples the examiner will request so requests do not become a scramble.
We work inside the compliance platform you already pay for. Vanta, Drata, Secureframe and comparable tools show which controls are failing; we configure them properly, connect the integrations and do the work the platform cannot do for you.
One plan, one owner list, one timetable and one weekly cadence. We chase internal workstreams, manage the audit firm's requests, track remediation to closure and give leadership a straight answer on whether the report date still holds.
A Type I reports on the suitability of design at a point in time. We prepare the control descriptions, evidence and system description so the examination can be performed cleanly, and so the same work carries directly into Type II.
A Type II tests operating effectiveness across a period, commonly three to twelve months. We make sure the controls operate and produce evidence for every day of that window, and we monitor them through it rather than discovering gaps at the end.
We help you select an appropriately licensed independent CPA firm, agree the examination plan and timetable, coordinate every evidence request, brief the people who will be interviewed and manage the flow of questions during fieldwork.
Where the examiner identifies exceptions or deficiencies, we work through the response: corrective action, control redesign where needed, management responses and the changes required before the next period.
A SOC 2 report covers a period that ends. We keep controls operating, evidence current, exceptions handled and scope changes governed, so the next period is a continuation rather than a rebuild.
Run together, one control set and one evidence base serves both, and the marginal cost of the second is a fraction of the first. We map the overlap honestly and identify what genuinely has to be built twice.
Where the report exists to unblock revenue, the programme is designed around procurement reality: what the buyer asked for, what will satisfy their security review, and how to hold the line credibly until the report is issued.
PLANNING YOUR PROGRAMME
The route to a report depends on scope, the systems and services involved, the criteria selected, the quality of existing evidence, audit-firm availability and the observation period a Type II requires. We establish those facts before committing to a plan.
You receive a defined scope, workstreams, responsibilities, timetable and fee. Where ISO 27001, ISO/IEC 42001 or established risk-management processes are already in place, we reuse what transfers and say plainly what does not.
Run an indicative SOC 2 readiness assessment or read how we support audit preparation.
QUESTIONS BUYERS ASK
A SOC 2 consultant runs the work required before an examination can succeed: defining scope and criteria, assessing readiness, implementing and remediating controls, writing policies, building the evidence base, managing the programme and coordinating the independent CPA firm. The consultant does the implementation; the CPA firm forms the opinion.
No. A SOC 2 examination must be performed by an independent licensed CPA firm, and independence rules prevent the firm that implemented your controls from also examining them. Hael prepares your organisation and coordinates the examination; the report is issued by the CPA firm.
Readiness and implementation typically run three to six months depending on the starting control environment and scope. A Type I follows shortly after. A Type II then requires an observation period, commonly three to twelve months, before the report can be issued. The audit firm's availability also affects the timetable.
A Type I reports on whether controls were suitably designed at a single point in time. A Type II reports on whether those controls operated effectively across a defined period. Most enterprise buyers ultimately want a Type II; a Type I is often used as an interim position.
Yes. We work inside whichever compliance platform you already use, configure it properly and connect the integrations that produce evidence automatically. Where you have no platform, we can run the programme on our own record and hand it over afterwards.
Yes, and it is usually the efficient route. The two overlap substantially in access control, change management, risk assessment, vendor management and incident response. One control set and one evidence base can serve both, with the differences handled deliberately rather than by accident.
Yes. We work with US technology and service businesses across the full programme, including US enterprise procurement expectations, AICPA context and engagement of a licensed US CPA firm to perform the examination.
Yes. Much of our SOC 2 work is for UK and European businesses selling into US enterprise accounts, where a SOC 2 report is what procurement asks for even when ISO 27001 is already held.
A single delivery plan, named control owners, a weekly working cadence, remediation tracked to closure, evidence readiness monitored through the observation period, management of the audit firm's request list, and honest reporting to leadership on whether the target report date still holds.
The report covers a period that has ended, so the work continues. Controls must keep operating, evidence must keep accruing, exceptions must be handled, and scope changes must be governed ahead of the next period. We support that cycle where clients want it.
GO DEEPER
Our SOC 2 guides cover cost, timelines, Type 1 against Type 2, evidence requirements, the Trust Services Criteria and how SOC 2 compares with ISO 27001.
