Included in audit fees
- SOC 2 examination
- Initial scope evaluation
- Control gap assessment
- Defining custom SOC 2 controls
- Yak audit platform access
- Control, evidence, and task management
- Defining evidence requests for optional epack automation
RENDER COMPLIANCE/Services
Good audits.
Clear answers.
Six ways we help you earn trust. What they are, how we work, and what to expect — in plain English.
Security. And the trust behind it.
SOC 2
What is it?
An independent examination against the AICPA Trust Services Criteria. Security is the foundation; Availability, Confidentiality, Processing Integrity and Privacy can be added as your customers and system require.
How do we do it?
TASKDESCRIPTIONTIMING
Discovery CallMutual introduction to assess selected Categories, Examination Dates, System Scope, Project Personnel and Project Approach.<1 hour
Gap Assessment2–6 hours of interviews with knowledgeable domain personnel. We evaluate current controls and identify gaps before fieldwork begins.1–2 weeks
Evidence CollectionTakes place over our included audit platform or your existing systems. Control ownership assigned; evidence collected and validated. When useful, we optionally configure epack automated evidence collectors to automate defined evidence requests. Collector development and setup are scoped separately.Ongoing
Fieldwork & TestingFocused interviews with key process owners; substantive testing of controls.3–4 weeks
Report DeliveryMulti-level review and final report issued with guidance on communicating results. Type 1: 6–10 weeks kickoff to report.<3 weeks after fieldwork
What does it cost?
SOC 2 Type 2 starting prices are below. Type 1 is quoted separately; final fees reflect your scope and readiness.
SOC 2 TYPE 2 / STARTING PRICES
Company sizeEmployeesStarting price
Startup1–10$16,000
Small10–100$22,000
Midsize100–200$26,000
Large200–2,000$34,000
Render Compliance reserves the right to modify pricing for factors including system complexity, program maturity, audit scope, and project timing.
Financial reporting controls
SOC 1
What is it?
An independent CPA examination of controls that matter to your customers' financial reporting. Think payroll, transaction processing or billing. Type 1 examines design at a point in time; Type 2 also tests how controls operate over a review period.
How do we do it?
TASKDESCRIPTIONTIMING
ScopingRisk-based scope and control objectives identified, controls aligned.ASAP
System Description ReviewWe review and refine your system description to ensure it accurately reflects your environment.During Planning
Evidence & TestingControl evidence tested against objectives as applicable to agreed examination scope.During the month leading up to planning
WalkthroughsWe walkthrough controls with your control owners to make sure we understand what we are testing.During fieldwork
Report Review & DeliveryMulti-level review for consistency and accuracy. Final report issued and operational recommendations delivered.<3 weeks after fieldwork
What does it cost?
A custom quote based on your systems, control objectives and examination scope.
Assurance you can share publicly
SOC 3
What is it?
A general-use, public-facing report derived from a SOC 2 Type 2 examination. It communicates assurance without the detailed controls and testing in the restricted-use SOC 2 report.
How do we do it?
TASKDESCRIPTIONTIMING
ScopingSOC 2 Type 2 and SOC 3 scoped together. Trust service criteria, system boundary and reporting objectives confirmed.Agreed at kickoff
SOC 2 ExaminationFull SOC 2 Type 2 audit conducted. SOC 3 derives from this examination; no duplicate effort.Follows SOC 2 schedule
General-Use ReportWe prepare the public-facing SOC 3 report you can share on your website or with prospective customers. Additional issuance timing agreed at scoping.<3 weeks after SOC 2 fieldwork
What does it cost?
An add-on quoted with your SOC 2 engagement, rather than a standalone audit fee.
A clearer view of your ISMS
ISO 27001Internal Audit
What is it?
An independent internal audit of your information security management system against ISO/IEC 27001 requirements and applicable controls. This is an internal audit, not certification itself.
How do we do it?
TASKDESCRIPTIONTIMING
Audit PlanningRisk-based audit plan developed around your ISMS scope, boundaries and applicable Annex A controls.Agreed at kickoff
Document ReviewPolicies, procedures and ISMS documentation reviewed for conformance with ISO/IEC 27001 requirements.During fieldwork
Interviews & Control TestingTargeted interviews with control owners and evidence testing against audit objectives.During fieldwork
Findings & ReportFindings and corrective-action priorities reported. Timing agreed ahead of your certification or surveillance date.Scope-based schedule
What does it cost?
A custom, scope-based quote that reflects the ISMS and controls being audited.
For Microsoft suppliers
Microsoft SSPAAssessments
What is it?
An independent assessment of the Microsoft Data Protection Requirements that apply to your organization, based on your supplier Data Processing Profile.
How do we do it?
TASKDESCRIPTIONTIMING
Profile & ScopingWe review your SSPA enrollment and Data Processing Profile, then map applicable Microsoft Data Protection Requirements to your environment.~1 month
Gap IdentificationControls mapped to DPR requirements; gaps identified. If remediation is needed, allow 2–3 months. Strong existing controls can shorten this.During scoping
Evidence & Control TestingEvidence collected and controls tested against applicable DPR requirements. Plan early around your assigned portal deadlines.~1 month
Attestation & Follow-upAttestation letter prepared in Microsoft's required format; we support portal submission and any follow-up. Actual schedule confirmed at scoping.Agreed at scoping
What does it cost?
A custom quote based on your supplier profile, assessment scope and readiness.
Make the next step a sensible one
ComplianceConsulting
What is it?
SOC 2 and ISO 27001 readiness, gap analysis and cross-framework mapping. For consulting-only engagements, we also offer implementation, ongoing compliance management and audit support.
How do we do it?
TASKDESCRIPTIONTIMING
DiscoveryWe learn your environment, goals and timelines. Framework selection and engagement scope confirmed. Best started 3–6 months before your first audit.Agreed at kickoff
Current-State ReviewDocuments and technical environment reviewed. Existing controls inventoried across in-scope frameworks.During engagement
Mapping & Gap AnalysisControls mapped to framework requirements; gaps identified and prioritized by risk and audit readiness.During engagement
Remediation RoadmapPrioritized roadmap delivered with practical next steps shaped around your team. Remediation may take 1–12 months depending on scope and readiness.Scope-based schedule
What does it cost?
A project-based quote reflecting the work involved and any ongoing support you need.
Service boundaries
What’s included. And what’s next.
Not included
- Control implementation
- Ongoing control maintenance
- Audit support services
- epack collector development and setup (scoped separately).
Multi-framework Leveraged Audits
What if my company needs more than one audit?
Render works with independent firms that specialize in their respective fields. Together, we align scope and timing, coordinate requests, and reuse relevant evidence where requirements overlap.
You get focused expertise with less duplicated effort. Each firm remains responsible for its own work and conclusions.
Your Render team
Render
Compliance
- SOC 1
- SOC 2
- SSPA
- HIPAA Security Assessments
- ISO 27001 Internal Audit
Independent partner
ISO Certification
Body
- ISO Certifications
Independent partner
FedRAMP &
CMMC Firm
- FedRAMP
- CMMC
Independent partners
Security
Specialists
- Penetration testing
- Managed security services
- Compliance management
- Privacy Specialists
Working together, from the start.Aligned scope & timelinesCoordinated requestsRelevant evidence reused
Your team is assembled around your needs. Partner services are scoped separately; each assessment or certification retains its own requirements. Security operations and compliance management stay separate from independent audit decisions.
Let’s plan your audits together ↗Tell us what your customers are asking for.
Talk to us.
See if you like us.
Maybe, even do a Gap Assessment with us, completely commitment-free.