The paperwork an auditor actually has to believe
Compliance Consulting
Most failed audits fail on paperwork describing a company nobody recognised: a policy nobody followed, evidence nobody had collected, a control that existed on a slide but not in practice. This practice writes down how the company actually operates and closes the real gaps against the chosen standard. It advises and documents; it does not run the technical tests a security audit or a penetration test perform separately.
How a compliance gap assessment actually runs
Framework selection, policy documentation and the evidence trail an auditor expects.
90 secSample frame · video pending01Before committing to an audit type
SOC 2 Type I or Type II is a real timing decision.
Customers often ask for one without knowing the difference matters. Four questions settle which one your current stage of readiness actually supports.
Do customers need proof of a point in time or over time?
A Type I report attests controls exist on a given date. A Type II report attests they operated effectively across a review period, usually months.
How long have your controls actually been running?
A Type II report needs controls operating consistently across the review window. A newly written policy has nothing to demonstrate yet.
What is the actual contractual deadline?
A Type I report is faster to obtain when a deadline is close. A Type II report needs the observation period built into the timeline from the start.
Which report do your specific customers actually require?
Some procurement teams accept a Type I as a first step. Others require Type II outright, which changes the whole preparation timeline.
| Type I | Type II | |
|---|---|---|
| Attests to | Design at a point in time | Operating effectiveness over time |
| Typical timeline | Weeks after readiness | Months, including observation period |
| Evidence burden | Lower | Continuous, across the period |
| Best fit | First-time, deadline-driven | Mature, ongoing customer trust |
02Agreed before the assessment starts
The ledger that keeps advisory work honest
Compliance engagements drift when advice quietly becomes an unpaid promise that the company already meets a standard it does not. This spells out the division from the outset: what you disclose, what gets assessed, what comes back as a recommendation, and which decision remains entirely yours.
- Your side
You bring
- The systems and data the certification needs to cover
- Any policies already written, however informal or outdated
- The target framework and the deadline attached to it
- Our side
We build
- A gap assessment against the chosen framework's requirements
- Policy documentation written to match how the company actually operates
- An evidence collection plan mapped to each control
- Your side
You receive
- A written gap assessment naming every missing control
- A policy set ready for an auditor's initial review
- An evidence checklist the team can work through independently
Never leaves you
- The decision on which framework to pursue
- Ownership of every policy once it is adopted
- The relationship with the chosen audit firm
Where the line sitsWe write the policy; you decide whether the company actually operates that way yet. A policy describing work nobody does fails the first audit interview.
03From gap assessment to audit day
Four stages, each closing on a written artefact
Certifications that stall usually skipped one of these stages. This system closes each one with a document the team can act on immediately.
Assess the gap honestly
Current practice gets compared control by control against the chosen framework, without assuming a policy exists just because someone once mentioned it.
Against the framework's actual requirementsWrite policy that reflects reality
Documentation gets drafted to match real operating practice, so an auditor's follow-up question has a true answer behind it.
Matched to how the company actually worksBuild the evidence trail
Each required piece of evidence gets tied to the control it supports, collected on a schedule the team can sustain after the engagement ends.
Mapped to a specific control, not a general folderPrepare for the audit interview
The team walks through likely auditor questions before the real interview, so nobody is improvising an answer about a control on the day itself.
Rehearsed before the auditor asks
04What actually moves the number
Four drivers, priced from the gap assessment
Compliance consulting is priced once the initial gap assessment scopes the work, because these four factors change effort by multiples.
Framework chosen and its control count
An ISO information-security certification carries a larger control set than a narrower framework, which extends both documentation and evidence work.
How much existing documentation is usable
A company with some real policy in place moves faster than one starting from an empty folder.
Number of systems and vendors in scope
Each additional system or third-party vendor adds its own evidence requirements to the collection plan.
Whether this is a first certification or a renewal
A renewal against existing evidence is typically faster than building a full certification programme from nothing.
05Evidence and proof
Paperwork that held up in the actual interview.
Compliance proof is an audit closed with no surprise findings, not a folder assembled the week before. These previews carry that bar while written client approvals are secured.
Explore case studiesA first SOC 2 report delivered ahead of a signed deadline.
Koru Health needed SOC 2 Type I to close an enterprise healthcare contract with a fixed deadline. A gap assessment and rewritten policy set carried the company through its first audit on schedule.
- Control gaps closed before audit
- 22
- Audit delivered against deadline
- On time
An EdTech platform's evidence trail rebuilt before a renewal.
Pillar Learning had let evidence collection lapse for a year since its last certification. A refreshed collection calendar closed every lapsed control before the renewal audit began.
- Lapsed controls found and current again
- 14
- Renewal audit findings
- None
Every policy actually matched what we do. The auditor noticed, and the interview took half the time we expected.
Sample · pending client approval
06Read this first
When compliance consulting is the wrong first move
Paying for policy documentation when the actual requirement is proof of technical resilience wastes the engagement. The exits are marked plainly below.
- Security Audits
The auditor needs technical proof, not documentation
Some frameworks expect evidence from an actual technical test, which a paperwork exercise alone cannot produce.
- Penetration Testing
You need to prove resilience against a real attacker
A contractual requirement for penetration test evidence needs an adversarial engagement, not a governance review.
- Application Security
The policy already exists and just needs implementing
If the documentation is already written and agreed, the gap is technical execution rather than advisory judgment.
| Shape | Best when | You direct | We carry |
|---|---|---|---|
| Gap assessment only | You need a documented starting point | The framework and deadline | The assessment and gap list |
| Full readiness programme | You want one team through audit day | Priorities each milestone | Policy, evidence and rehearsal |
| Renewal support | A certification already exists | The renewal schedule | Evidence refresh and gap closure |
07Straight answers
Asked before an audit gets scheduled.
01Which framework should we pursue first?
Usually whichever one a signed or pending customer contract actually requires. Chasing a framework nobody is asking for yet rarely earns back the effort quickly.
02Do you also run the technical testing an auditor might require?
No, that runs as a separate security audit or penetration test engagement. This practice handles governance, documentation and evidence, not technical testing itself.
03How long does a first-time certification take?
A SOC 2 Type I can move in a few months from a clean gap assessment. An ISO information-security certification and a SOC 2 Type II typically take longer, given their larger evidence burden.
04What does compliance consulting cost?
Pricing follows the chosen framework, existing documentation and how many systems fall in scope, set after an initial gap assessment. A renewal typically costs less than a first-time certification.
05Can you help with GDPR or HIPAA specifically, not just SOC 2?
Yes, the same gap assessment and documentation method applies to any named framework or regulation. The controls differ; the discipline of matching policy to practice does not.
06Will you tell us if we're not actually ready for an audit?
Yes, and that is often the most useful early finding. Walking into an audit with unclosed gaps costs more in findings than delaying it by a few weeks.
07Do you work directly with our chosen audit firm?
Yes, and coordinating with the audit firm's expectations is part of the readiness work. We prepare the evidence they will actually ask to see.
08What happens after we pass the audit?
A collection calendar keeps evidence current so the next renewal does not start from the same gap. Compliance work that stops the day the report arrives tends to lapse within a year.