Independence is the point of your work and the source of its value. It also means the report ends at the diagnosis, and everyone in the room knows it.
The readiness assessment lands badly
You run it properly and hand back the findings. Then comes the question independence reserves for somebody else: so how do we fix this? The client has just paid for the diagnosis, learns the cure belongs to another firm, and leaves the call still looking for its name.
So they go shopping on their own
Remediation turns out to be sold in project statements of work by firms hearing the context for the first time. A managed security provider quotes them as though they were a company several times their size. The compliance platform they get pointed at reports the problem and leaves the repair to them. The bill to pass the audit outgrows the contract that triggered it.
A company that was trying to do the right thing decides the whole exercise is a racket. That is the client we exist for, and now the one you have a name for.
One sends us a client who needs the work done. The other is what your fieldwork looks like once it has been.
For the client who just went pale.
You tell them we exist. That is the whole of it, and it can happen off the engagement, by email or on LinkedIn, at whatever remove your obligations call for. We give them 30 minutes, free, and a straight answer on whether we can help. Where the fit is wrong they hear it on that call.
When we are operating a client you audit.
The reciprocal half, and the one that changes your week as much as theirs. Where we run the environment, the controls are operated on a calendar and the evidence accumulates as a byproduct of the work. The record is already written when you arrive, because it was written as the work happened.
Where the line sits
We implement and operate. You test and attest. The independence rules you work under keep those two jobs in separate firms, which is exactly why this works.
Everything that makes your opinion worth having, held entirely on your side of the line.
The work that needs an operator: turning controls on, keeping them on, and leaving a record that they were.
Attestation stays with your firm, on every engagement, permanently. That boundary is what makes a referral safe for you to make.
Telling a client about us puts your judgement behind the introduction. These are the terms that make that a reasonable thing to do.
You know this better than we do: under AICPA guidance on independence in SOC engagements, implementation and attestation belong to separate firms, and a breach can void the report your client paid for. We set out how we keep the specialists separate, with that guidance cited, on the partner model.
We tell a client you sent them, or list you as a partner, only on your written say-so. An introduction stays an introduction, and we present it as exactly that.
Scope covers the work we take on and the work we decline. Our refusals are published on the operated partnership page, and the same list applies to anyone you send us.
Significant on-premises infrastructure, hardware, and telephony sit outside what we run, and a referred client hears that on the first call. You hear it from us at the same time.
Credentials, configuration, and documentation live in accounts the client owns. That keeps the evidence theirs, and it keeps an exit simple.
Ours as well as theirs. What a clean exit looks like, in both directions, is written up on the switching page.
Referral terms are agreed per partner, and one of the options is purely reciprocal. This page describes how we work, ahead of the terms of any particular arrangement.
Our own external certification is still ahead of us. We run our own program on the same platform our clients use, with our Microsoft 365, Google Workspace, AWS, Cloudflare, and 1Password tenants connected to it, and we can evidence every control except the two marked open here.
You are going to ask, so it is here in writing first. An operator who volunteers the gaps in their own program is the one worth handing a client to.
One sentence, and it can happen off the engagement if independence requires it. An introduction is all it is, and all it needs to be.
Free, and straight. Where the fit is wrong we say so on that call and, where we can, point them at someone better suited.
What we took on and what we declined, so the engagement reads the same to you as it does to us when you arrive to test it.
Start with the client whose assessment ended in a list and an open question.
One call about one client, and a straight answer on whether we are the right operator for them.
The same argument, written for your client. Ready to forward as it stands.
We use cookies
Essential cookies keep the site running. With your permission, we also use analytics and functional cookies to improve the experience. Read our Cookie Policy.