A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →An audit opinion is the conclusion a licensed CPA firm writes into a SOC 2 report. An unqualified opinion is clean. A qualified opinion notes exceptions that are not pervasive. An adverse opinion states the controls do not meet the criteria. A disclaimer means the firm could not gather enough evidence to conclude at all.
Unqualified is the target and qualified is survivable. Adverse opinions are rare, largely because an engagement heading that way tends to be paused before an opinion is written.
A paused engagement is the outcome to plan against. The audit fee is already spent, the buyer waiting on the report has to be told the date moved, and fieldwork gets paid for twice.
traztech delivers What actually goes wrong in a SOC 2 audit for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
It comes up when somebody asks whether you can fail a SOC 2. The honest answer is yes, in more than one way. There is no pass or fail stamp, there is an opinion, and two of the four possible opinions are outcomes you would not want to hand a buyer.
It also comes up when a report lands with exceptions in it. An exception is not automatically fatal to a deal, but it is read, and the management response printed underneath it is read too.
Yes, though not as a stamp. Adverse opinions and disclaimers are both real outcomes. What usually happens to an unprepared company is worse than either: the engagement stalls during fieldwork and the firm recommends pausing, so you have paid for an audit that produced no report and re-entering fieldwork means paying again.
Usually not on its own. It invites questions. A reviewer will want to know what the exception was, why it happened and what changed, so the management response matters as much as the finding.
The licensed CPA firm performing the examination, independently. A readiness partner cannot influence it, which is exactly why the report is worth something.