Respond to a SOC report request
Confirm the report your customer requires, the services it must cover, and the delivery deadline before planning readiness work.
SOC 1 & SOC 2 readiness.
Prepare for a SOC 1 or SOC 2 examination with report scoping, control-gap assessment, policy and evidence support, and remediation coordination. An independent licensed CPA firm performs the examination and issues the report.
Readiness
SOC 1+SOC 2
Preparation for independent CPA examination
- SOC readinessPreparation, not the independent examination
- Type I or Type IIScope and reporting period agreed with the CPA firm
- Control evidenceRequirements mapped to owners and records
- Separate feesExamination and specialist testing scoped separately
When to use this service.
Define the reporting scope
Clarify the system boundary, report type, criteria or control objectives, and period with the selected CPA firm.
Prepare control evidence
Identify control owners, address gaps, and maintain evidence of the agreed controls. A compliance platform can support collection but does not replace control operation.
Best fit: service businesses and SaaS companies of 25 to 200 people whose enterprise customers or partners are asking for a SOC report, with leadership willing to actually operate the controls.
Not the right fit: companies wanting a certificate without changing anything, or needing the audit itself; the audit is performed by a licensed CPA firm we help you select and prepare for.
SOC report types.
SOC 1
Addresses controls relevant to customers' internal control over financial reporting. Applicability depends on the services you provide and how customers use them.
SOC 2
Addresses controls relevant to the applicable Trust Services Criteria categories, such as security, availability, confidentiality, processing integrity, and privacy.
Readiness support
We help organize scope, gaps, policies, and evidence. The CPA firm independently determines examination procedures, findings, and its opinion.
| SOC 1 | SOC 2 | |
|---|---|---|
| Who asks for it | Your customers' finance teams and their financial auditors | Your customers' security and vendor-risk teams |
| What it covers | Controls that affect your customers' financial reporting (billing, payroll, claims) | The Trust Services Criteria: security, availability, confidentiality and more |
| Who issues it | A licensed CPA firm | A licensed CPA firm |
| Type I | Control design at a point in time | Control design at a point in time |
| Type II | Design and operating effectiveness over a specified period | Design and operating effectiveness over a specified period |
Confirm the required report, system scope, and reporting period with the customer and CPA firm. AICPA SOC 2 overview.
Our process.
Readiness work is planned around the required report and the independent CPA firm's examination scope.
-
Step 01
Confirm report and examination scope
Agree SOC 1 or SOC 2, Type I or Type II, the system boundary, and applicable criteria or objectives with your team and selected CPA firm.
-
Step 02
Assess control gaps
Review current controls and evidence. Create a readiness plan with owners, required changes, and evidence responsibilities.
-
Step 03
Operate controls and collect evidence
Your team implements and operates the controls while we track readiness and evidence. Any observation period, specialist testing, and fees are agreed separately.
-
Step 04
Support the CPA examination
Organize the evidence package and coordinate responses to examination requests. The independent CPA firm performs the examination and issues its report; a favorable opinion is not guaranteed.
Why Hardenwell.
A dedicated advisor
A named, CISSP-certified advisor leads your engagement, with specialist support where needed. Responsibilities and the agreed deliverables are documented before work begins.
No referral commissions
We do not receive referral commissions from auditors, testing firms, brokers, or software vendors. External services are identified separately so you can review their scope and fees.
Control mapping and examination evidence
Your readiness work includes agreed control-gap findings, owners, and evidence coordination. The independent CPA firm's examination and opinion are separate from this service.
Client reviews.
GRF CPAs & Advisors
What stood out was the specificity. The advisory team did not just say we should improve access controls or MFA; they helped us verify what was configured, where the exceptions were, and how to show progress.
Smile Brands
The pressure point was answering security questions with confidence. Their team helped us verify what was actually in place, document the gaps, and tighten up the items our IT team could handle.
Grassi
The technical findings mattered, but the bigger value was how the Hardenwell advisor explained them. They translated security risk into business risk for our partners, then worked with IT on the details. Decisions moved faster because both sides understood the same issue.
Frequently asked questions.
No. Hardenwell provides readiness and coordination support. An independent licensed CPA firm performs the examination and issues the report. Its fees and engagement are separate.
SOC 1 concerns controls relevant to customers' financial reporting. SOC 2 concerns the applicable Trust Services Criteria. Confirm the requested report with the customer and the CPA firm; the requester's job title alone does not determine the correct report.
Timing depends on current controls, required changes, evidence availability, the report type, and the CPA firm's schedule. Type I addresses a point in time; Type II also evaluates operation over a specified period. We agree a plan after scoping, not a guaranteed report date.
No. Testing needs depend on system risk, selected controls, commitments, and examination expectations. If testing is needed, an independent specialist performs it under a separately approved scope and fee.
Book your scope call.
Thirty minutes with an advisor.
We cover your organization, your deadline, and who is asking for what. You leave knowing the likely scope, the timeline, and your next step, with the price fixed in writing before any work starts.
Prefer phone or email?
(754) 216-9664 [email protected]
Do not include PHI or sensitive records in booking notes. See our Privacy Policy.