SOC 2 · ISAE 3402 · C5
SOC 2 help from someone who has done the auditing
I am Hoang Tran, a former Senior Manager in Digital Audit at a UK Big Four firm, with more than ten years in technology audit. Osianic is my business. It does two things: workpaper preparation for audit firms, and SOC 2 readiness assessments for companies.
What Osianic does
Part A · audit firms
For audit firms: workpaper preparation
You send the evidence package for one engagement. You get back a documented workpaper for every control, in your own template and style. Your reviewer reviews, concludes and issues.
Part B · companies
For companies: a SOC 2 readiness assessment
See what an auditor is likely to find, before your audit starts. The fee is fixed, you see an updated draft after every run, and you get a clear list of what to fix first. You order it and upload your files in the client portal.
What is a SOC 2 report?
A SOC 2 report is an independent report on how a company protects the data it holds for its customers. Only a licensed audit firm can issue one.
Osianic does not issue reports. It prepares companies for the audit, and it prepares workpapers for the firms that carry out the audit. A workpaper is the document that records how a control was tested, what evidence was seen and what was concluded.
How the work is done
A person decides
For an audit firm, I decide every proposed conclusion myself before a workpaper is returned, and the firm's reviewer concludes. For a company, I review the whole readiness draft and confirm or change every point in it, and the company signs off the reviewed draft before it is released as its readiness report.
AI prepares the paperwork
AI tools sort the evidence and draft the documents. On work for an audit firm they send nothing: I send every file myself. On a readiness assessment, the drafts a company sees between runs are prepared by AI tools and released by the client portal. They are provisional, and each point that needs a judgement is marked "as recommended, to be confirmed by Osianic". I write and send every email myself.
Agreements come first
No evidence is sent before the terms are agreed. An audit firm signs a contract and a data processing agreement. A company accepts the terms in the client portal, and I accept the engagement before it uploads anything. The terms say where the evidence is kept, who can see it and when it is deleted.
What Osianic does not do
- Osianic does not issue SOC 2 reports. A licensed audit firm does that.
- Osianic does not build or run a company's controls. That keeps the assessment independent.
- Osianic does not promise an audit result. An honest assessment is worth more than a comfortable one.
About
I have spent more than ten years in technology audit, and was a Senior Manager in Digital Audit at a UK Big Four firm. I have planned, tested and reviewed the kind of work this site describes.
Osianic is a one-person business. When you write, you reach me.
Contact
Tell me whether you are an audit firm or a company, and what you need.
I read and answer every email myself. There is no form on this site. A company that wants a readiness assessment emails me first. I show the service, and then I open its account in the client portal, which is a separate address.