UK SOC 2 consultants
- SOC 2 is a United States standard, but UK companies need it when their buyers are American. It is a sales requirement, not a UK regulatory one.
- Only a licensed CPA firm can issue the report. A UK consultancy prepares you for the examination; it cannot sign the opinion.
- Most fieldwork is remote, so a UK company can use a US audit firm without difficulty. The location of your consultant matters more than the location of your auditor.
- UK consultancy fees for a first programme typically run £12,000 to £40,000, with the auditor's fee separate and usually quoted in dollars.
- If your buyers are mostly European, ISO 27001 may serve you better. Many UK companies eventually hold both, and the second costs far less than the first.
Why UK companies pursue SOC 2
UK companies pursue SOC 2 for one reason: an American customer has asked for it. SOC 2 is an attestation standard set by the American Institute of Certified Public Accountants, it carries no weight in UK law, and no UK regulator requires it. It became necessary here because United States procurement teams made it a condition of buying.
A UK SOC 2 consultant prepares your company for that examination. The examination itself, and the report that follows, can only come from a licensed CPA firm. That division is fixed, and it is the first thing to be clear about when comparing providers.
Why would a UK company need SOC 2 at all?
Three situations account for almost all of it.
You are selling software or services to United States enterprises, and their security review names SOC 2 specifically. This is by far the most common trigger, and it usually arrives attached to a deal that is already in progress.
You are selling to a UK or European company whose own parent or major customers are American, so the requirement cascades down to you.
You already hold ISO 27001 and a US buyer has said it is not sufficient. This happens less often than it used to, but it still happens, and it is worth pushing back politely and asking whether an ISO 27001 certificate plus a completed security questionnaire will do, because sometimes it will.
If none of those applies, ISO 27001 is usually the better first investment for a UK company, because it is recognised across Europe and produces a certificate you can publish. Our ISO 27001 service page sets out how that works.
Who can issue a SOC 2 report for a UK company?
Only a licensed CPA firm, which means a firm licensed under the United States system. Several such firms serve UK clients directly, and a number of UK accountancy practices hold the necessary licensing or work through affiliates to issue reports.
The practical consequence is that "SOC 2 consultants" and "SOC 2 auditors" are different things, and a firm advertising SOC 2 services in the UK may be either. Before you sign anything, ask one question: will you be issuing the report, or preparing us for someone else to issue it? Both are legitimate. Confusing them is what causes problems in month five.
Most of the examination is conducted remotely through evidence requests and interviews, so using a United States audit firm from the UK is normal and creates few practical difficulties beyond scheduling calls across time zones.
What does SOC 2 cost a UK company?
Auditor fees are broadly similar to the United States, because the standard is American and most of the work is remote. Firms invoicing in sterling sometimes price modestly above their US equivalents to cover the time-zone overlap. Consultancy fees vary more widely.
| Component | Typical UK range |
|---|---|
| Readiness or gap assessment | £5,000 to £20,000 |
| Full readiness programme, small to mid-sized company | £12,000 to £40,000 |
| Auditor fee, Type 1 | Usually quoted in dollars, $5,000 to $25,000 |
| Auditor fee, Type 2 | Usually quoted in dollars, $15,000 to $60,000 |
| Penetration testing | £4,000 to £20,000 |
| Compliance platform subscription | £6,000 to £20,000 a year |
Budget for the currency
Budget for the currency as well as the number. If your auditor invoices in dollars and your board approved a sterling figure, the exchange rate moves against you between approval and invoice more often than anyone expects.
How SOC 2 fits with UK GDPR
SOC 2 and UK GDPR are not the same thing and neither satisfies the other, but they overlap enough that the work should be done once.
The Privacy criterion within SOC 2 addresses how personal information is collected, used, retained and disposed of, which covers similar ground to your UK GDPR accountability obligations. Access control, encryption, vendor oversight, incident response and records of processing all serve both. What SOC 2 does not do is establish your lawful basis for processing, your data subject rights procedures or your international transfer arrangements. Those remain separate obligations under UK law.
If you are running both, set the control set up once and map it to both, rather than maintaining two parallel documentation sets that slowly diverge. That mapping is part of what our readiness and gap assessment produces.
SOC 2 or ISO 27001 for a UK company?
| SOC 2 | ISO 27001 | |
|---|---|---|
| Output | A report, covering a stated period | A certificate, valid three years with annual surveillance |
| Who issues it | A licensed CPA firm | An accredited certification body |
| Where it carries weight | United States buyers, and increasingly global technology procurement | Europe, the UK, and international markets generally |
| Can you publish it | No, reports are normally shared under NDA | Yes, the certificate is public |
| Typical first-year cost | $30,000 to $150,000 all in | Comparable, often somewhat lower for a small scope |
| Recurring commitment | Annual examination | Annual surveillance audit and annual internal audit |
The overlap between the two
The two share a large proportion of their underlying controls. A UK company that already holds ISO 27001 will usually find the marginal cost of adding SOC 2 is a fraction of doing it from nothing, and the reverse is also true.
Choosing a UK SOC 2 consultant
The questions are the same ones that apply anywhere, and they are set out in full in how to choose a SOC 2 compliance consultant. Three are worth emphasising in a UK context.
Ask whether the firm has taken UK companies through a United States examination before, and how many. Preparing for an AICPA examination from a UK base involves conventions and evidence expectations that are not obvious from a distance.
Ask which audit firms they work with and whether those firms are set up to serve UK clients. A working relationship saves weeks.
Ask how they handle the ISO 27001 overlap if you hold it or expect to. Doing the two as one control set rather than two projects is the largest single saving available to a UK company.
What to do next
Confirm in writing what your buyer will accept, including whether a Type 1 report or an ISO 27001 certificate would satisfy them. That answer can change your budget by tens of thousands of pounds.
Then get a view of where you stand. Our free readiness diagnostic gives a first picture, and the SOC 2 service page sets out how we run the full programme.
References
- American Institute of Certified Public Accountants, Trust Services Criteria, TSP Section 100 (2017 criteria with revised points of focus, 2022). https://www.aicpa.org
- Information Commissioner's Office, UK GDPR guidance. https://ico.org.uk
- International Organization for Standardization, ISO/IEC 27001. https://www.iso.org
FAQ
Is SOC 2 recognised in the UK?
It is recognised commercially, not legally. No UK regulator requires it, but UK companies selling to American buyers are regularly asked for it.
Can a UK firm issue a SOC 2 report?
Only if it is a licensed CPA firm, or works through one. Many UK firms offer SOC 2 preparation without being able to issue the report, which is a legitimate service, but ask which one you are buying.
Do I need a UK-based auditor?
No. Most fieldwork is remote and using a United States firm is common. Time-zone overlap for interviews is the main practical consideration.
Should a UK company do ISO 27001 or SOC 2 first?
It depends on where your buyers are. American buyers ask for SOC 2. European and UK buyers generally ask for ISO 27001. If you have both, do the one your live deals need first and add the other afterwards at reduced cost.
Does SOC 2 satisfy UK GDPR?
No. They overlap on security controls but SOC 2 does not address lawful basis, data subject rights or international transfers. Both obligations stand separately.
About Hael
Hael is an advisory firm specialising in AI governance and security compliance. We take companies through SOC 2, ISO 27001, ISO/IEC 42001 and the EU AI Act, from first assessment to report, and maintain the position afterwards. On engagements involving regulated financial services firms we work alongside Buckingham Capital Consulting, the partner firm that has advised UK payment and e-money firms on FCA authorisation and compliance since 2013.
This guide is general information and is not professional advice on your particular circumstances.