What does a compliance consultant actually do for SOC 2?
What Does a Compliance Consultant Do?
A compliance consultant is the person who translates SOC 2 requirements into actions for your team. They know what auditors expect, what evidence satisfies each criterion, and how to avoid common mistakes. For most startups, the consultant is the difference between a smooth audit and a painful one.
Typical Engagement Scope
| Phase | What the Consultant Does | Your Team's Role |
|---|---|---|
| Discovery | Interviews your team, reviews infrastructure | Provide access and answer questions |
| Gap assessment | Identifies missing controls and documentation | Review findings |
| Policy writing | Writes or reviews 4–7 security policies | Approve and sign policies |
| Control mapping | Maps your controls to Trust Services Criteria | Confirm controls are accurate |
| Evidence planning | Creates an evidence collection checklist | Collect the evidence |
| Readiness review | Simulates auditor testing | Fix remaining gaps |
| Audit support | Coordinates with the auditor, joins walkthrough calls | Participate in meetings |
What You Get at the End
A good consultant delivers:
- Written policies tailored to your infrastructure
- A controls matrix mapping each control to TSC criteria
- An evidence collection plan with specific artifacts needed
- A readiness report with any remaining gaps
- Audit coordination and walkthrough preparation
The Problem With Consultants for Startups
Consultants are expensive ($5,000–$30,000), slow (6–12 weeks for a full engagement), and the deliverables are only as good as their understanding of your specific stack. Most consultants work from templates they customize based on interviews — they do not read your codebase or inspect your infrastructure configuration directly.
When a Consultant Makes Sense
If you are pursuing multiple compliance frameworks, have a large and complex infrastructure, or need someone to own the program long-term, a consultant is worth the investment.
For a straightforward SOC 2 Type I with Security scope, Screenata handles the core consultant tasks — policy writing, control mapping, evidence collection — at a fraction of the cost by reading your actual codebase.