Question 1

What does a SOC 2 examination cost?

Accepted Answer

Cost depends on scope (number of Trust Services Criteria), system complexity, and examination type (Type I vs. Type II). Contact us for a scoping call to get a tailored estimate.

Question 2

How long does a SOC 2 engagement take?

Accepted Answer

A Type I examination typically takes 4–6 weeks. A Type II requires a review period of at least 6 months, with the examination adding 4–8 weeks after the period ends.

Question 3

What is included in the SOC 2 report?

Accepted Answer

The report includes the auditor’s opinion, system description, applicable Trust Services Criteria, tests of controls, results, and any exceptions or deficiencies with recommendations for improvement.

Question 4

How do we share the SOC 2 report with customers?

Accepted Answer

SOC 2 reports are restricted-use documents. They are typically shared through secure portals or under NDA with specified parties such as customers, auditors, and regulators.

Question 5

What is the difference between SOC 2 and SOC 3?

Accepted Answer

SOC 2 is a detailed, restricted-use report. SOC 3 covers the same Trust Services Criteria but with less detail, and it can be freely distributed — for example, posted on your website.

Question 6

Do we need SOC 1 or SOC 2?

Accepted Answer

SOC 1 focuses on controls relevant to customers’ financial reporting (ICFR). SOC 2 focuses on operational controls (Security, Availability, etc.). Most SaaS and cloud companies need SOC 2; financial service providers often need SOC 1.

Question 7

What is a readiness assessment?

Accepted Answer

A readiness assessment evaluates your current control environment before a formal examination. It identifies gaps and produces a remediation plan so you can enter the examination with confidence.

Question 8

How does Ezzy Assurance use AI?

Accepted Answer

AI assists with evidence organization, completeness checks, and consistency review. Auditors remain accountable for planning, testing, conclusions, and final reporting. Client data is handled under strict confidentiality policies.

Frequently asked questions.