1. Clarify the buyer’s acceptance criteria
Before committing to a delivery date, ask which product must be covered, whether the buyer requires Type 1 or Type 2, which trust services categories they expect and how they will review the report. Record the answers alongside the sales opportunity.
SOC2 is an independent CPA assurance report, rather than an ISO-style certificate. Type 1 addresses a specified date; Type 2 also examines control operation over a defined period. Agree the period with the auditor and buyer; a readiness tool cannot replace it.
2. Describe the service customers actually use
Prepare a scope brief naming the customer-facing systems, data handled, production regions, supporting teams and critical vendors. Show how overseas customers, China-based developers and operations staff access production. Identify who approves this description.
For AI services, include model providers, prompt and output storage, retrieval sources and whether customer data is used for training. A deployment diagram should explain these dependencies and the boundary between production and development.
3. Turn controls into dated operating evidence
Assign one owner and one reviewer to each evidence request. For recurring controls, schedule collection throughout the agreed period instead of rebuilding records at the end. Use an evidence register with the system, date range, source, owner, reviewer and storage link.
- People: retain onboarding, role changes and leaver access-removal records for the population in scope.
- Technology: retain access reviews, approved changes, vulnerability remediation and backup restore-test results.
- Governance: retain risk decisions, supplier reviews, incident exercises and management approvals.
4. Make the audit handoff workable across borders
Use bilingual control labels and a shared glossary so evidence owners and reviewers refer to the same systems. Agree working hours, escalation contacts and a redaction and access plan before sharing evidence. Review sensitive data handling with the appropriate privacy and legal specialists.
Anuthand’s recommended next step is a short scoping workshop followed by an evidence backlog with owners and due dates. Engage the independent CPA firm early to confirm the examination approach, while keeping management responsible for the controls and source records.
5. Project fees
The total fee is SGD 30,000, including consultancy services and external audit fees.