FAQ
Frequently Asked Questions
General FAQs
Common questions about Sage Audits, our services, and how we work. If you don't see what you're looking for, connect with us and we'll point you in the right direction.
Assurance services involve an independent evaluation of an organization's information, typically conducted by a qualified third party such as a CPA. The goal is to enhance the trustworthiness and relevance of data that decision-makers rely on. These services can encompass reviews of financial documents or broader assessments of internal processes and controls, verifying their accuracy and reliability. Assurance services help reduce the risk of misinformation, enabling more confident and informed decision-making.
IT audit involves evaluating IT systems, controls, and processes to identify risks or inefficiencies. IT assurance goes a step further: it focuses on providing stakeholders with confidence that those systems and controls are suitably designed and operating effectively, based on an independent examination conducted by a licensed CPA firm.
Our team brings experience working with organizations across technology, finance, government, and higher education, through our combined backgrounds at Big Four firms and in-house IT security roles. We've handled gap assessments, vendor management, and the design and testing of controls for SOC 1 and SOC 2 reports, as well as SOX compliance. Whether you're a cloud-based startup or an established financial services provider, we're accustomed to adapting our approach to different organizational structures, regulatory requirements, and technical environments.
We operate on a fixed-fee engagement model once the scope of work is defined. This means no unexpected hourly charges, and our focus stays on delivering a thorough engagement rather than tracking billable hours. Use our interactive pricing calculator to get a transparent estimate based on your specifics, with no obligation.
SOC 2 Reporting FAQs
Everything you need to know about SOC 2 audits: what they are, who needs them, how they work, and what to expect from the process.
SOC 2 (System and Organization Controls 2) is an audit report issued by a licensed CPA firm that evaluates how a service organization manages data to protect the privacy and security of its customers. It is governed by the AICPA and assesses controls related to one or more of five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. A SOC 2 report is not a certification. It is an independent auditor's opinion on whether your controls meet the stated criteria. If you want to go deeper, our complete guide to SOC 2 audits and compliance covers everything you need to know.
If you sell software or services to enterprise customers, you will almost certainly be asked for one. SOC 2 has become the de facto proof of security controls in the SaaS and technology space. The question is usually not whether you need it, but when. If a deal has stalled waiting on a vendor security review, or you are about to go upmarket, it is time.
Our 2-minute assessment walks through the common questions used to determine whether a SOC 2 report is needed or on the horizon. If you are still unsure, or not quite ready to commit to a full audit, reach out and we are happy to talk through your situation.
The fastest way to find out is to take our free assessment. It walks you through the same questions we ask when prospects call us: who your customers are, what data you handle, and what's driving the conversation in the first place. It takes about two minutes and gives you a personalized recommendation. Try the SOC 2 assessment.
If your situation doesn't fit the standard buckets, get in touch and we'll talk it through. SOC 2 isn't always the right answer, and depending on your circumstances there may be other ways to demonstrate trust to your customers without committing to a full audit.
A Type I report describes your controls as of a single point in time: it is a snapshot. A Type II report covers a defined period (typically six to twelve months) and provides evidence that your controls actually operated effectively throughout that period. Enterprise buyers and sophisticated security teams almost always want Type II. Type I is useful as a first step when you need something quickly or you are building toward Type II. Read a deeper breakdown of Type I vs. Type II.
The AICPA defines five Trust Services Categories for SOC 2: Security (required in every engagement), Availability, Processing Integrity, Confidentiality, and Privacy. Security, also called the Common Criteria, covers access controls, risk management, and incident response. Most companies scope their first SOC 2 to Security alone. Additional categories are added when relevant to the services you provide or what your customers contractually require. See a full breakdown of all five categories.
SOC 2 is an attestation, not a certification. A certification (like ISO 27001) is issued by an accreditation body and results in a certificate you can display. An attestation is an independent opinion issued by a licensed CPA firm under the AICPA's attestation standards. The output is an audit report, not a certificate. There is no passing or failing score. The auditor opines on whether your controls were suitably designed and, in a Type II, whether they operated effectively over the examination period.
You may hear companies say they are "SOC 2 certified" but that phrasing is technically incorrect. The accurate term is that they have received a SOC 2 report or completed a SOC 2 examination. The rigor, independence, and legal weight behind a CPA-issued attestation is different from a self-assessed or third-party certification.
A readiness assessment is not required, but it is strongly recommended for first-time engagements. It identifies gaps between your current controls and what the audit will test, so you can remediate before the observation period begins rather than discovering issues during fieldwork. Companies that skip readiness often face findings that delay their report. Think of it as a dry run that significantly de-risks the real audit. Here are practical steps to get your team prepared.
The timeline depends on two key factors: whether you are going through a readiness assessment first, and whether you are pursuing a Type I or Type II. Readiness alone typically requires at least 100 hours of your team's time to gather evidence, close gaps, and prepare documentation. A Type I can then take 3 to 6 months from kickoff to issued report. A Type II adds a defined observation period on top of that, typically six to twelve months of operating history, before the audit fieldwork even begins. We scope timelines to your business calendar so audit activity does not pile up during your busiest periods. See the phases of our audit process.
It depends on your scope, control environment complexity, and whether you need readiness work first. SOC 2 Type I engagements typically start around $15,000. Type II engagements start in the $20,000 range and can go well above $60,000 for larger or more complex environments. Use our interactive pricing calculator to get a transparent estimate based on your specifics, with no obligation.
Only a licensed CPA firm can issue a SOC 2 report. The AICPA's attestation standards require that SOC 2 engagements be performed by a certified public accountant. Compliance platforms, consultants, and SaaS vendors can help you prepare, but they cannot issue the actual report. When evaluating auditors, look for firms with demonstrated SOC 2 experience, direct partner involvement, and no conflicts of interest from also selling readiness tools or software. Learn why your SOC auditor choice matters.
SOC 1 Reporting FAQs
Common questions about SOC 1 reports, ICFR controls, and what to expect from your engagement.
A SOC 1 report is an independent examination of controls at a service organization that are relevant to user entities' internal control over financial reporting (ICFR). Conducted under AICPA SSAE No. 18 (AT-C Section 320), a SOC 1 report provides assurance to your clients and their auditors that your controls are suitably designed and, in the case of a Type II report, operating effectively over a specified period. Unlike SOC 2, which evaluates controls against fixed Trust Services Criteria, SOC 1 reports are scoped to custom control objectives tied to how your services affect your clients' financial statements.
SOC 1 reports are designed for service organizations whose operations directly impact their clients' financial reporting. This includes payroll processors, loan servicers, benefits administrators, claims processors, financial transaction processors, and third-party administrators (TPAs). If your clients' external auditors need to evaluate controls at your organization as part of their financial statement audit, a SOC 1 report gives them the independent assurance they require.
A SOC 1 Type I report evaluates whether your controls are suitably designed as of a specific date. It is a point-in-time assessment that does not test whether controls operated effectively over a period. A SOC 1 Type II report tests both the design and operating effectiveness of controls over an audit period, typically 6 to 12 months. Most clients and their external auditors ultimately require a Type II report because it demonstrates that controls work consistently over time. Type I reports are useful as a first step, especially when a customer needs evidence quickly or your controls are newly implemented.
For a SOC 1 Type I engagement, expect approximately 4 to 6 weeks from scoping to final report delivery. For a SOC 1 Type II, the audit period itself is typically 6 to 12 months (the period over which your controls are tested), with fieldwork and report delivery adding approximately 6 to 8 weeks after the period ends. If a readiness assessment is included, add 4 to 8 weeks upfront for gap analysis and remediation guidance. We target a draft report within two weeks of completing fieldwork.
SOC 1 audit fees vary based on scope and complexity. Type I engagements typically start around $16,000. Type II engagements start higher and can go well above that depending on the number of control objectives, locations, environment complexity, and whether subservice organizations are in scope. We provide a fixed-fee proposal before the engagement begins so there are no surprises. Use our pricing calculator for an estimate, or contact us for a custom quote.
SOC 1 examinations are performed under the AICPA Statement on Standards for Attestation Engagements (SSAE) No. 18, AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting. The engagement is also governed by the AICPA guide, Service Organizations: Reporting on Controls at a Service Organization Relevant to User Entities' Internal Control over Financial Reporting, which provides the framework for how these examinations are structured, scoped, and reported.
A SOC 1 report is issued by an independent, licensed CPA firm and includes management's description of the service organization's system, the defined control objectives, and the auditor's opinion on whether those controls meet the stated objectives. For Type II reports, it also includes the results of testing controls for operating effectiveness across the full audit period.
SOC 1 and SOC 2 serve different purposes. A SOC 1 report focuses on controls relevant to user entities' Internal Controls over Financial Reporting (ICFR). The control objectives are custom, defined based on how your service affects your clients' financial statements. A SOC 2 report evaluates controls against the AICPA's fixed Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy). The right report depends on what your clients and their auditors are asking for: if they need assurance about financial reporting controls, it is SOC 1; if they need assurance about data security and operational controls, it is SOC 2. Some organizations need both.
CUECs are controls that your clients (user entities) are expected to implement for your controls to function as intended. For example, your system may process payroll calculations accurately, but it is your client's responsibility to ensure the payroll inputs they submit are correct. SOC 1 reports document CUECs clearly so that user auditors understand what their client is responsible for versus what your organization controls. Well-defined CUECs reduce ambiguity during your clients' financial statement audits.
When your organization relies on subservice organizations (vendors like cloud hosts, payment processors, or data centers), the SOC 1 report must address their role. The carve-out method excludes the subservice organization's controls from your report. Your report describes the services they provide, but user auditors will need separate assurance from that vendor. The inclusive method brings the subservice organization's controls into your report scope, which requires their active participation in the audit. The right choice depends on what your user entities expect and the nature of the subservice relationship. We help you decide during scoping.
A bridge letter covers the gap between the end of your SOC 1 report period and a user entity's fiscal year-end. It is a management assertion (issued by your organization, not the audit firm) confirming that no significant changes to controls occurred during that gap. Bridge letters are common when your report period does not perfectly align with every client's year-end. As your auditors, we can provide progress letters or engagement letters that you may share with clients to demonstrate that your next audit is underway.
Start by identifying the services in scope and the control objectives that are relevant to your clients' financial reporting. Document your control activities and gather evidence that those controls are operating as designed. Determine whether subservice organizations are part of your environment and how you will address them (carve-out or inclusive). Consider a readiness assessment to identify gaps before the formal audit begins. We recommend engaging your audit firm early so you can scope the engagement together and avoid surprises during fieldwork. See our full audit process →
Yes. We coordinate directly with user auditors on scope, timing, control objectives, and CUEC questions. You do not need to act as an intermediary between your clients' auditors and us. This is especially important for SOC 1 engagements, where user auditors often have specific questions about control objectives and how they relate to their client's financial reporting environment.
Yes. If you are already managing controls and evidence in a GRC platform like Drata, Vanta, Scytale, or similar tools, our audit process adapts to your workflow. We pull from your existing repository rather than asking you to duplicate work. If you are not using a platform, we provide our own structured approach to evidence collection and control mapping.
Advisory & Consulting FAQs
Questions about our IT advisory and consulting work: what it covers, when it makes sense, and how it fits alongside a formal audit engagement.
An IT audit is an independent examination of your controls and processes, governed by professional standards and resulting in an opinion issued by a licensed CPA firm. IT advisory is a consulting engagement: we work alongside your team to assess gaps, design control frameworks, improve processes, and prepare for compliance requirements. The distinction matters operationally. Advisory is collaborative and forward-looking. An audit is objective, governed by attestation standards, and results in a formal report. Many clients engage us for advisory work first, then move into an audit once their environment is ready.
Our consulting work typically falls into a few categories: GRC program development, control framework design and implementation, SOC 2 gap analysis and audit readiness, vendor risk management, and security control reviews. Engagements are scoped to your specific situation. We don't operate on one-size-fits-all packages, and we're not trying to sell you a platform or software alongside the work.
Yes. Audit readiness work is a common engagement, and there is no conflict of interest in helping you prepare for an audit contracted with another firm. We can review your control design, identify gaps, and help your team gather the right evidence, with the goal of reducing findings and making the audit process smoother. If you later decide to move your audit to Sage, that is a natural next step, but there is no obligation.
If you are preparing for your first compliance engagement, building out an internal control program, or responding to customer security questionnaires, advisory typically comes first. A full audit is the right step when you have a defined observation period, established controls, and a contractual or commercial need for an issued report. We often see clients move through advisory, readiness, and then audit as a natural progression. If you're not sure where you land, reach out and we'll help you figure out the right starting point.