SOC 2 Audits
Prove Your Controls, Earn Your Customers’ Trust
Customers and prospects in the US, and more and more in the UK, want independent evidence that you protect their data. A SOC 2 report gives them that evidence. PJR United Kingdom delivers SOC 2 Type 1 and Type 2 examinations through our trusted, licensed CPA partner, so you get one point of contact here in the UK and a report your customers will accept.
What Is SOC 2?
SOC 2 (System and Organization Controls 2) is a reporting framework developed by the American Institute of Certified Public Accountants (AICPA). It assesses how a service organisation protects the systems and data it handles for its customers.
A SOC 2 examination measures your controls against the AICPA’s Trust Services Criteria. At the end, an independent auditor issues a detailed report with their opinion on those controls. You can share the report with customers, prospects, partners and auditors under a non-disclosure agreement.
SOC 2 is an attestation, not a certification. Under AICPA rules, only a licensed CPA firm can issue a SOC 2 report. This is why PJR UK delivers SOC 2 through a dedicated CPA partner, while we manage the relationship, the planning and the coordination with any ISO certification you hold.
The Five Trust Services Criteria
Every SOC 2 report covers Security. You choose the other criteria based on the services you provide and what your customers expect.
- Security (required): Systems are protected against unauthorised access, disclosure and damage. Also called the Common Criteria.
- Availability: Systems are available for operation and use as committed or agreed.
- Processing Integrity: Processing is complete, valid, accurate, timely and authorised.
- Confidentiality: Information designated as confidential is protected as committed or agreed.
- Privacy: Personal information is collected, used, retained, disclosed and disposed of properly.
SOC 2 Type 1 vs SOC 2 Type 2
| Type 1 | Type 2 | |
| What it tests | Whether controls are suitably designed | Whether controls are suitably designed and operate effectively |
| Timeframe | Covers a single point in time | Covers an observation period, typically 3-12 months |
| Best for | First report or an urgent customer request | Report most enterprise customers ask for |
| Typical route | Readiness, then Type 1 | Type 1 (optional) Then annual Type 2 |
Who Needs SOC 2?
SOC 2 is designed for service organisations that store, process or transmit customer data. Typical clients include:
- SaaS and cloud software providers
- Managed service providers (MSPs) and managed security service providers (MSSPs)
- Data centres, hosting and colocation providers
- Fintech, payments and insurtech companies
- HR, payroll and outsourced business process providers
- Healthtech and digital health platforms
Request a Quote
"*" indicates required fields
SOC 2 and ISO/IEC 27001: Better Together
ISO/IEC 27001 is the international standard for an information security management system. SOC 2 is the attestation report many North American customers ask for. The two frameworks share much of the same ground, including access control, risk assessment, change management, incident response and supplier management.
With PJR UK, you can plan both together: one control set, shared evidence and coordinated audit timing. Your ISO/IEC 27001 certification comes from PJR and your SOC 2 report from our CPA partner, giving you a recognised certificate for global markets and the report your US customers expect.
Your SOC 2 Journey with PJR
- Initial consultation: We discuss your services, your customers’ expectations and the right report type.
- Scoping: We agree the systems, locations and Trust Services Criteria in scope.
- Readiness assessment (optional): A gap review shows what needs to be in place before the audit begins.
- Type 1 examination: The auditor assesses the design of your controls at a point in time.
- Type 2 observation and testing: Your controls are tested for operating effectiveness over the agreed period.
- Report issued: You receive your SOC 2 report, ready to share with customers under NDA.
- Annual renewal: Keep your report current with a yearly Type 2 examination.
Three Paths to SOC 2 with PJR
- New to SOC 2: Start with scoping and an optional readiness assessment, then move to your first Type 1 or Type 2 report with clear timelines and no surprises.
- Moving from Another Provider: Already have a SOC 2 report? We will plan your next examination so there is no gap in coverage for your customers.
- Adding SOC 2 to ISO/IEC 27001: Already certified with PJR or another body? Reuse your ISMS controls and evidence to reach SOC 2 faster.
Why Choose PJR UK for SOC 2?
- One UK point of contact: Our UK team manages your project from first call to final report.
- Trusted, licensed CPA partner: Your report is issued by our trusted, licensed CPA firm, so it meets AICPA requirements and is accepted by customers.
- More than 30 years in certification: PJR has supported organisations worldwide with independent audits for over three decades.
- Joined-up cyber security assurance: Combine SOC 2 with ISO/IEC 27001 and other PJR cyber security services.
- Practical, transparent process: Clear scoping, fixed timelines and auditors who explain what they find.
SOC 2 Frequently Asked Questions
Q: Is SOC 2 a certification?
A: No. SOC 2 is an attestation. A licensed CPA firm examines your controls and issues a SOC 2 report with an independent opinion. There is no SOC 2 certificate. PJR UK delivers SOC 2 through a trusted, licensed CPA partner.
Q: What is the difference between SOC 2 Type 1 and Type 2?
A: A Type 1 report assesses whether your controls are suitably designed at a single point in time. A Type 2 report also tests whether those controls operated effectively over a period, usually 3 to 12 months. Most customers ask for Type 2.
Q: How long does a SOC 2 audit take?
A: It depends on your readiness. A Type 1 can often be completed within a few weeks once controls are in place. A Type 2 needs an observation period, typically 3 to 12 months, followed by fieldwork and reporting.
Q: Do UK organisations need SOC 2?
A: SOC 2 is not a legal requirement in the UK, but it is widely requested by North American customers and investors, particularly for SaaS, cloud, fintech and managed service providers. Many UK organisations hold both SOC 2 and ISO/IEC 27001.
Q: Can I combine SOC 2 with ISO/IEC 27001?
A: Yes. The two frameworks overlap significantly, so one set of controls and evidence can support both. PJR UK can coordinate your ISO/IEC 27001 certification alongside your SOC 2 examination to reduce duplication.
Q: Which Trust Services Criteria do I need?
A: Security (the Common Criteria) is mandatory in every SOC 2 report. Availability, Processing Integrity, Confidentiality and Privacy are optional and should be chosen based on the services you provide and what your customers expect.
Partner with PJR Today!
Contact PJR to discuss SOC 2 and the next steps for your organisation. Call our UK sales office on +44 (0) 2033 071986 or request a quote online.