Leveraged Audit – ISO 27001 + SOC 2

Your CFO informs you there is budget next fiscal year to complete both ISO 27001 and SOC 2.

And you are the lucky professional tasked with implementing the projects.

But you’re smart – you realize that given the overlap in subject content (estimated at 80% between typical controls for SOC 2 and ISO 27001 Annex A controls) – you want to make sure your team’s effort implementing controls and gathering evidence is not wasted.

Not to mention you want to minimize your own headache managing the whole thing. What’s the most effective way to complete the projects?

In this article we’re going to walk you through each component of a leveraged audit, and how to get the most bang for your buck by completing ISO 27001 and SOC 2 as part of a cohesive compliance plan carried out by best-in-class independent practitioners.

Joint Proposal

If you want to make sure projects are truly aligned, start from the beginning. Ensure that the leaders of the ISO audit team and the SOC audit team attend the same Proposal calls. This is a great initial signal on whether the teams can work effectively together and communicate cohesively.

Joint proposal calls are also a good litmus test – audit teams that don’t have processes for working with partner firms, or aren’t willing to collaborate from the proposal stage, are probably not the right fit for a leveraged audit.

Aligned Project Scoping

System Scope

As much as possible, try to ensure that each audit is auditing the same product / system.

Specifically – ensure the Scope section of your ISO 27001 Statement of Applicability lines up with the described system scope and boundaries in the SOC 2 System Description.

It won’t be possible to have duplicative scopes across the projects – they are separate standards with separate requirements, potentially separate customer bases and separate needs – but aligning to the fullest extent possible will only help manage the projects effectively throughout their lifecycle.

Audit Dates

As much as possible, line up the ISO 27001 audit cycle with the SOC 2 Exam dates to maximize overlap. ISO 27001 audits run on a three-year cycle. SOC 2 is typically over an annual examination over a 12-month period.

We recommend scheduling the ISO audit walkthroughs within 30 days of SOC 2 fieldwork. This keeps both engagements close enough to share evidence and stakeholder momentum without creating scheduling conflicts for your team.

This allows your team to reuse walkthroughs and evidence across both engagements while the information is still fresh, and keeps both audit teams moving on a shared timeline.

Develop Aligned Controls

In both ISO 27001 and SOC 2, service organizations first perform a risk assessment and then out of the risk assessment, define a framework of controls.

For ISO 27001, there is a baseline of controls called Annex A that form the required starting point.

SOC 2 controls must be developed to address the risks that the organization won’t achieve its service commitments or system requirements according to the selected Trust Services Criteria.

Using a uniform control framework will save you much grief down the line.

Unified Project Management

One Project Timeline

Create a single timeline across both projects for all major project steps, including scoping and gap assessment, implementation / remediation of any gaps, requesting evidence and evidence deadlines, testing and report/certification issuance.

Shared Messaging Channel

Use a shared Slack channel across both audit teams and the internal stakeholders for sharing items like Project Timeline and audit task tracking, shared project documents, and quick communications.

This helps to avoid key information getting lost in emails stretching back months across multiple parties.

Shared Evidence Collection

This is a big one and where the time savings really starts to show.

There is typically close to 80% overlap in subject matter between SOC 2 controls and ISO 27001 controls. And though the control language might differ, the essence of the control activity is often very closely aligned. And if you’ve done the hard work up front during Scoping to match up SOC 2 and ISO as much as possible, many controls may be completely shared between the two projects.

So to capitalize on all this overlap, use one source of audit evidence requests for each project – a Unified Evidence Request List – that is accessible by internal users and each audit team.

This way any duplicate requests are only made once to you and each audit team filters to view only the applicable items.

Continuous Improvement

Audit report and certification in hand, don’t rest on your laurels. Conduct a debrief meeting with each audit team to improve the audit process and share any operational recommendations. A leveraged audit gets more efficient each cycle when both teams carry those lessons forward into the next round of planning and fieldwork.

What about Big Firms who offer Everything?

You could work with a large audit firm who offers everything under one roof. There are advantages to this – namely they can align their team processes even more closely and ensure every auditor across teams functions the same way.

But you run into three problems: A) frequently, different teams in large companies function as separate companies, so you end up getting sold on cohesion but receiving dysfunction. B) frequently, the firms who specialize in everything, excel in nothing. You end up with a mediocre service experience across all teams. C) independence suffers when the ISO 27001 team and SOC 2 team are under the same roof (are you really going to flag a finding that was labeled ‘Pass, Clean’ on the audit that’s already done? Doesn’t make your company look good).

The Mastermind + Render Leveraged Audit

Mastermind and Render Compliance put true leveraged audits into practice. Our defined and battle-tested process supports our two firms working closely together from Day 1 of introduction to the client, through audit fieldwork, project close, and supporting continuous monitoring around the year.

Each company functions separately to be the best at what we do (ISO Certifying Body and SOC 2 attestations) while retaining our independence and being able to move quickly. Each firm is staffed by small teams of highly experienced auditors to ensure a best-in-class audit experience.