SOC 1 and SOC 2 Readiness and Attestation

Most companies searching for a SOC 2 readiness CPA in California arrive holding two quotes, for what they have been told is one unavoidable split in the work.

It is not unavoidable. This practice holds the CPA licence that permits the attestation and the CISA and CISM credentials that make the readiness work substantive. One scope decision, one methodology, one set of judgments about what counts as evidence.

SOC 1 or SOC 2 readiness: what a CPA in California can actually issue

SOC 1 addresses controls at a service organisation that are relevant to its clients' internal control over financial reporting. If your customers' auditors need to rely on what your system does to their numbers (payroll processing, claims administration, loan servicing, transaction processing) SOC 1 is the report they need.

SOC 2 addresses the Trust Services Criteria: security, and optionally availability, processing integrity, confidentiality and privacy. This is what enterprise buyers and their security teams ask for. Security is always in scope; the others are elective and each one added expands the examination.

Type 1 reports on the design of controls at a point in time. Type 2 reports on operating effectiveness across a period. A large share of companies skip Type 1 and go straight to Type 2, and if controls are genuinely implemented that is usually right, enterprise buyers want evidence that controls operated, not that they were designed.

Type 1 earns its place in one specific situation: a deal contingent on demonstrable progress within weeks, where a Type 2 observation window cannot be compressed to fit. It buys credibility while the window runs.

Scope decisions that determine the cost

Three decisions set the size of the programme, and all three are made before any control is written.

System boundary. Which product, which infrastructure, which supporting processes. Drawing the boundary around the whole company when the customer commitment concerns one product is the most expensive unforced error available in SOC 2.

Trust Services Categories. Security alone satisfies most enterprise requests. Availability matters where you have made uptime commitments. Confidentiality where contracts impose specific handling obligations. Processing integrity is narrower than it sounds and is genuinely relevant to transaction processors. Privacy overlaps heavily with the CCPA and GDPR work and is frequently added without anyone establishing that a customer asked for it.

Observation window. Three months for a first Type 2 is standard, extending to six or twelve on renewal. Shorter windows reach a report sooner; longer windows are what mature buyers eventually expect.

The readiness assessment

Three to five weeks, and the single highest-return step in the programme. Skipping it is the most commonly cited cause of audit delays and qualified opinions, for a straightforward economic reason: a gap found during readiness is remediated at remediation cost, while the same gap found during fieldwork is billed at audit rates, may require a control to operate over a fresh window, and can produce an exception in the report itself.

What the assessment produces: an agreed system boundary and description outline; an inventory of controls that already exist, including the many that exist informally and have never been documented; a gap list with effort, dependency and sequence attached; an evidence plan specifying what must be retained and by whom; and a realistic date for the observation window to open.

The gaps that appear in almost every first engagement

• No formal risk assessment. The Trust Services Criteria require one. Most companies have security practices but no documented risk assessment driving them.
• Access reviews that have never been performed. Or performed once, before anyone thought to keep the evidence.
• Vendor management as a spreadsheet of names. Without risk tiering, without obtaining subservice organisation SOC reports, and without reading the complementary user entity controls in them.
• Onboarding and offboarding without evidence. The process happens; nothing records that it happened for a specific person on a specific date.
• Incident response documented but never exercised. A plan nobody has walked through is not a control.
• Change management bypassed for hotfixes. Legitimate under pressure, undocumented afterwards.
• Policies written and never acknowledged. A policy nobody has read or signed provides no evidence that anyone was informed.

None of these are difficult. They are simply invisible until someone asks for evidence, and they take longer to fix than companies expect because most require a control to operate for a period before it can be tested.

Compliance automation platforms

Drata, Vanta, Secureframe, Scrut and similar tools genuinely reduce total programme cost (commonly by a meaningful margin) by automating evidence collection and continuous monitoring. Where a client already runs one, the engagement works inside it.

What the platform does not do: decide the system boundary, determine whether a compensating control is adequate, tell you an exception will draw a qualification, or remove the auditor's fee. Automation reduces internal effort; it does not remove the requirement for someone to form and sign an opinion.

For companies choosing a platform, the advice is consistently to scope the programme first and select second. The reverse order produces a tool configured against a boundary nobody agreed, and re-scoping afterwards is more work than scoping properly once.

Timeline and budget, stated plainly

From a standing start, nine to twelve months to a first Type 2 report is realistic; roughly six is achievable for an organised company using a three-month window and an automation platform. The components are readiness and remediation (four to eight weeks of concentrated work, longer where the control environment is immature), the observation window, fieldwork of one to three weeks, and two to six weeks for the report.

Published 2026 market data puts specialist-firm Type 2 audit fees broadly in the $15,000,$50,000 range, with national firms materially above that. Total first-year programme cost (audit, readiness, tooling and internal time) commonly lands between $30,000 and $80,000 for a small or mid-sized company. Penetration testing, platform subscription and remediation are the line items most often left out of an initial budget.

And the cost recurs. The observation window for the next cycle begins as soon as the current one closes, and a gap between reporting periods is something enterprise buyers notice.