Qualifying a SOC 2 readiness lead

Most readiness enquiries are not engagements. Nine questions on a thirty minute call sort them, and four specific answers should end the call politely.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

A SOC 2 readiness enquiry is worth pursuing when three things are true: a named customer has asked for the report in writing, somebody inside the company owns the work, and the date they have been given is achievable. If any one is missing you are looking at a research project that consumes two proposals and four calls before going quiet. Roughly half of inbound readiness enquiries fail at least one of the three, so the qualification call matters more than the pitch.

If getting the enquiry is the harder problem, where readiness work comes from covers the channels and what each costs per signed client.

The nine questions, in order

1. Who asked you for this, and what did they write? The exact words matter. "SOC 2" means the buyer has not decided either. "SOC 2 Type 2" is a hard constraint on the calendar and rules out any short path. No named requester at all means you are talking to somebody doing internal groundwork.
2. What date does the report have to exist by, and where did the date come from? A date from a contract is real. A date from a board deck moves. Work backwards on the call and say out loud whether it holds.
3. Who inside the company owns this? A name, and whether that person can change how engineering works. If the answer is a committee, or the office manager, the engagement will stall on decisions nobody is empowered to make.
4. What have you already done? Listen for a platform purchased and unused, which is common, and for policies downloaded and never approved, which is more common. Both are information about how they buy.
5. How many production environments, and how many clouds? The single biggest driver of your effort, and the fastest way to know whether your standard price applies.
6. Do you have a single identity provider? If no, add meaningfully to the estimate and say why on the call. Most prospects have never had anybody explain the cost of not having one.
7. Where does customer data live, and do you hold personal information about people in Quebec or health information for a custodian? Two questions that change scope, and two that a US competitor will not ask.
8. What is the budget, and has anybody approved it? Ask directly. "We are still working that out" this late in the call means no budget, and it is better to know in minute twenty than after a proposal.
9. Who else are you speaking to? Not to compete on price, but to find out whether they are running a real process or collecting quotes to satisfy a procurement rule.

Reading the answers

Four answers that should end the call

"We need a Type 2 report in six weeks"

There is no version of this that works. The observation window is calendar time. Explain the arithmetic, offer the Type 1 path, and if they insist on the Type 2 date, decline. Somebody else will take it and be blamed when it does not arrive. Send them the timeline page afterwards.

"Can you also do the audit?"

Asking once means they do not yet understand what they are buying, which is fine. Asking again after you explain independence means they are shopping for a firm willing to blur it. Neither the engagement nor the report will be worth anything.

"We just need the policies"

Sometimes true and a legitimate small sale. More often they intend to adopt a document set and present it as a control environment, and your name ends up attached to the exceptions. Sell the assessment instead and see whether they buy it.

"What would you charge, roughly, before we discuss scope?"

Not a disqualifier on its own, but a number given before questions five through seven is one you will regret. Give a published floor and move back to scope. If they will not discuss scope, they are collecting quotes.

What to send after the call

The proposal follows within forty-eight hours, and what goes in it is shorter than what most firms send.

One email, the same day, three paragraphs. What you heard, in their words. What you would do and roughly what it costs. One thing they should do this week whether or not they hire you. The third paragraph is what gets forwarded internally.

If they are not ready, say so and give them the thing that helps. Sending a prospect to a free tool that scores their own controls closes more work six months later than a follow-up cadence does. The readiness scorecard and checklist are both built for that handover.

The case against qualifying hard

If your practice is new and your calendar is empty, take the marginal engagement at a reduced price. You get a reference, a completed audit to point at, and a relationship with whichever CPA firm signs the report. Qualification discipline is what you adopt once you have more enquiries than capacity. Applying it in year one leaves you with a very clean pipeline of nothing.

What does not change with experience is the six-week Type 2. Take the marginal client. Do not take the impossible date.