SOC 2 consultancy
- A SOC 2 consultancy engagement runs in three phases: scope and assess, build, then support through the examination.
- Fixed fee is usually better than a day rate for a first programme, because it forces the scope conversation to happen first.
- Agree a written responsibility matrix at the start. It prevents almost every dispute that happens later.
- Ask what happens if the observation period is extended or the auditor requests remediation. That clause is where cost overruns live.
- Ongoing support after the report is a separate decision, and worth making deliberately rather than by default.
How the engagement works
A SOC 2 consultancy engagement is a defined piece of professional work with phases, deliverables and terms. Most difficulties in these engagements are contractual rather than technical: scope that was never written down, responsibilities that were assumed, or a fee model that rewarded time rather than completion.
This guide covers how the engagement itself is structured. What the services actually consist of is in SOC 2 consultancy services.
The three phases
Phase one: scope and assess. Usually two to four weeks. The firm establishes your system boundary, the criteria in scope, your current position against each requirement, and what closes each gap. The output is a written assessment, a remediation plan and a timetable. This phase should be priced separately and should be useful on its own, whether or not you continue.
Phase two: build. Usually six to sixteen weeks depending on the gaps found. Policies written, controls implemented, evidence framework established, people briefed. This is the largest phase by effort and the one where a fixed fee protects you most.
Phase three: examination support. Runs alongside and after the observation period. Evidence coordination, interview preparation, managing the accounting firm, handling findings during fieldwork.
Our own engagements run to the same three stages, described as scope, build and assure on the about page.
Fee models
| Model | How it works | Best when |
|---|---|---|
| Fixed fee, whole programme | One price for a defined scope and set of deliverables | A first SOC 2 with a clear boundary. Most companies. |
| Fixed fee per phase | Each phase priced separately, with a decision point between | You want to test the firm before committing to the build |
| Day rate | $800 to $2,000 a day against an estimate | You have someone internal running it and need judgement at specific points |
| Retainer | Monthly fee for ongoing ownership | The need continues after the report, across questionnaires and multiple frameworks |
For a first programme, fixed fee is generally the better arrangement. It forces the scope conversation to happen before the work rather than in month four, and it puts the risk of a longer build on the firm that is estimating it.
Whichever model, ask for the fee to be itemised and confirm in writing that the accounting firm's fee is outside it. It almost always is.
The responsibility matrix
The single most useful document at the start of an engagement is a table listing every workstream with one name against it. Who writes the policies. Who configures the identity provider. Who chases the evidence owners. Who books the auditor. Who briefs the interviewees. Who answers the buyer's questions when they arrive.
Most disputes in these engagements trace back to an item nobody claimed. A written matrix costs an hour and removes the argument.
Terms worth settling before you sign
What triggers a change of fee. New systems added to scope, an additional criterion requested by a customer, a corporate acquisition. Know the mechanism before it happens.
What happens if the observation period is extended. If the auditor requires remediation and a re-test, the period runs longer. Ask whether support through that extension is inside the fee.
Who owns the documentation. Your policies, control descriptions and evidence records should be yours, in your systems, at the end. Confirm this in writing.
Whether ongoing support is included, optional or absent. The observation period and the year after are where programmes drift. A firm whose engagement ends at the readiness assessment leaves you exposed for the hardest part.
Commission and referral arrangements. Ask directly whether any payment passes between the firm and any accounting firm or platform vendor. For our part, we take none, and it is stated on our about page.
What good delivery looks like week to week
A weekly written update is a reasonable expectation: what moved, what is outstanding, what is needed from you and by when. A named practitioner with committed hours rather than a rotating team. Escalation when something is not moving, rather than silence followed by a deadline problem.
If you are three weeks in and do not know what is outstanding, that is worth raising immediately rather than at the next milestone.
When the engagement should end
Two reasonable endpoints, and the choice belongs to you rather than to the firm.
At the report, if SOC 2 was a one-off requirement and someone internal will own the annual cycle afterwards.
Continuing, if buyer questionnaires keep arriving, other frameworks are coming, or nobody internal has the hours to maintain the cadence. That continuing work is our continuous governance and assurance service, and it is a substantially smaller cost than rebuilding a lapsed programme.
What to do next
Ask two or three firms for a written proposal against the same stated scope, then compare the responsibility matrix and the exclusions before comparing the fees. Two proposals with different scopes are not comparable at any price.
Our free readiness diagnostic gives you a first view, and the SOC 2 service page sets out how our engagements are structured.
References
FAQ
How is a SOC 2 consultancy engagement structured?
Three phases: scope and assess, build, then examination support. Each should have defined deliverables and a stated fee.
Fixed fee or day rate?
Fixed fee for a first programme, because it forces the scope conversation up front and moves estimation risk to the firm. Day rate suits companies with an internal owner needing occasional judgement.
How long does an engagement last?
Commonly three to five months of active work, plus support through an observation period of three to twelve months.
What should the contract say about scope changes?
It should name what triggers a fee change, such as adding systems or criteria, and how that change is agreed. Vague wording here is where overruns start.
Should support continue after the report?
That depends on whether anyone internal will maintain the controls and answer buyer questions. Programmes that stop entirely tend to pay close to full price again the following year.
About Hael
Hael is an advisory firm specialising in AI governance and security compliance. Every engagement has a named practitioner and an agreed scope, timetable and fee, and runs to three stages: scope, build and assure. We are not a certification body, we do not issue reports, and we take no commission from audit firms or platform vendors. On engagements involving regulated financial services firms we work alongside Buckingham Capital Consulting, the partner firm that has advised payment and e-money firms on FCA authorisation and compliance since 2013.
This guide is general information and is not professional advice on your particular circumstances.