Methodology
A sequenced audit process, not a black box.
Every FinAudit CPA engagement follows the same six stages, whether you are pursuing your first SOC 2 or aligning multiple frameworks across a global group. You always know where you are, what comes next, and what it costs.
Scoping
We agree exactly what is in scope: which frameworks, which systems, which locations, and whether you need a point-in-time or period-of-time examination. You leave this stage with a fixed fee and a clear plan, not an open-ended engagement letter.
Readiness & gap review
We map your current controls against the criteria and hand you a plain-language list of what to fix before the clock starts. No jargon, no vague "improve your posture" advice. You see precisely where you stand and what closes each gap.
Evidence & fieldwork
We collect and examine evidence with as little disruption to your team as possible, using your existing tools wherever we can. We ask for what we need once, in an organized way, so your engineers are not chasing screenshots for weeks.
Testing
We test each control for design and, where the report covers a period, for operating effectiveness. We raise issues early rather than saving them for the end, so nothing in the final report is a surprise.
Reporting & QA
We draft the report, run it through independent quality review, and issue a document written to survive scrutiny from your customers, their auditors, and their security teams. Every statement is one we can stand behind.
Continuous support
Assurance is not a one-time event. We plan your next window, your next framework, and your renewal, so year two is smoother than year one and each report builds on the last.