How to get SOC 2 readiness work

The best source of readiness work is the CPA firm that cannot legally do it. Everything else on this page is what you do in the months before that relationship exists.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

SOC 2 readiness is one of the few consulting markets where a structural rule builds your pipeline. Independence rules forbid the CPA firm issuing the opinion from doing the readiness work, and every one of their clients needs somebody to do it. Two or three referring audit firms will keep a two-person practice busy, and those relationships are worth more than every other channel here combined. Earning one takes six to eighteen months, which is why the rest of this exists.

We operate a directory and sell listings on it. Read the directory section below with that in mind.

What does a readiness client cost to acquire?

Cost per signed engagement, not cost per lead. Readiness has a long consideration cycle, so a channel producing cheap leads that never sign is the most expensive one you can run.

Those ranges assume engagements between $18,000 and $45,000 CAD, which is where most Canadian readiness work sits. If you sell $8,000 fixed-fee gap assessments, paid search and conferences stop making arithmetic sense long before the table suggests, and referral and content are the only two channels left.

How do you get an audit firm to refer you?

Not by asking. A CPA firm referring you is putting its own client relationship behind your work, and what it is protecting is fieldwork efficiency. An auditor's economics are hours. A client who arrives with complete populations, a written system description and evidence organized by criterion turns a six-week engagement into a three-week one. That is the whole pitch, and it is about their margin rather than your quality.

1. Do two or three engagements without a referral. You cannot start here, and firms will not refer to a practice with no completed audits behind it.
2. Ask your clients which firm they engaged, then ask the client to introduce you to the engagement partner after the report is issued. An introduction from the shared client is worth twenty cold emails.
3. Turn up with the evidence pack rather than a capability deck. Show the index, the population queries, the system description. Auditors evaluate you on the artifacts you hand their staff, not on your positioning.
4. Ask what their last three readiness handovers got wrong. You will get a specific list, and it is the requirements document for how you should work.
5. Be scrupulous about independence. Never suggest you can influence the opinion, never co-brand, never propose a fee split. Any of the three ends the relationship and deservedly.
6. Send a short note when a shared client's report is issued, saying what you would do differently. Firms remember the practice that reviews its own work.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Does writing actually work in this market?

Yes, slowly, and worse than it used to. Every compliance platform publishes readiness content at industrial volume and outranks you on every head term. What they cannot publish is the page that says a twelve-person company does not need their product, or a page about Canadian privacy obligations their US content team has never heard of, or the specifics of a control your client failed. That is where a small practice wins. It is a narrow seam, and nine to eighteen months of consistent writing is the realistic timeline.

If you can only do one channel and you are under two years old, do referrals. Writing pays out on a horizon longer than most small practices can fund, and a founder writing two posts a month while pipeline is empty is usually avoiding the harder work of asking people for introductions.

When is cold outbound worth doing?

Trigger-based outbound at fifteen well-researched messages a week outperforms untargeted outbound at four hundred, and it is the only version worth a founder's time. Timing matters more than what you send. Leading with a specific observation about their trust page still beats leading with your credentials.

Are directory listings worth paying for?

We sell these, so here is the arithmetic rather than the argument. A Verified listing on this network is $300 CAD a month or $3,000 CAD a year. If your average readiness engagement is $25,000 CAD and you close one in four qualified enquiries, the listing pays for itself on a single signed client every three years. That is a low bar. It is also why the free tier exists and why the paid one is priced where it is: you should be able to measure a directory before you pay it anything, here or anywhere else.

A directory makes you findable by the buyer who has already decided to hire somebody and is building a shortlist. It does not create demand. If nobody knows they need readiness work, a listing does nothing for you. If buyers who are already shopping never see your name, it is the cheapest fix available. A free claimed listing is the right starting point either way, and the firm listing page has both tiers and the form.

If you only do three things

0 of 0 done · Reset

• Ask every past client for an introduction to the audit partner they used, after their report is issued rather than during fieldwork
• Write down a fixed-scope readiness offer with a price, so a referrer can describe what you sell in one sentence
• Set up a saved search for Canadian companies hiring their first enterprise account executive, and send fifteen researched messages a week
• Claim a free listing wherever buyers shortlist, and pay for none of them until you can see referral traffic
• Publish one page about something you actually fixed, with the numbers in it, rather than four pages about what SOC 2 is

The other pages in this set go deeper on each part of the sale: packaging the offer, qualifying the lead, writing the proposal, and subcontracting to CPA firms.