SOC 2 Without a Compliance Platform — how the no-software route works

A SOC 2 without compliance software is not a workaround — it is the original route. SOC 2 is an attestation, not a certification: a licensed CPA firm examines your controls and signs an opinion, and that is the entire mechanism. Before the platform category existed, every attestation worked the same way it can work for you today: a consultant runs readiness, evidence lives in organized shared storage on a calendar cadence, and the CPA firm examines and signs. Nothing in the standard asks for software. This guide walks the route end to end — including what it honestly demands of you, and the situations where a platform really is the better call.

Five stages, no subscription anywhere in them

The no-platform route has the same skeleton as every SOC 2 engagement — preparation, then examination. What changes is who does the preparation: a readiness consultant instead of software guiding your own team. Here is the whole route, in order.

• 1. Gap assessment. The consultant maps your current practices against the Trust Services Criteria in scope and produces a gap list with owners. This is diagnosis, not remediation — our guide to the SOC 2 readiness assessment explains what a real one covers.
• 2. Control design. Each gap becomes a control fitted to how you actually operate — your cloud, your ticketing, your team size — rather than a generic template. Small teams get controls a small team can actually run.
• 3. Policies. The consultant drafts the policy set to match the controls as designed, and your leadership reviews and adopts them. Policies describe what you do. Auditors test whether you do it.
• 4. The evidence calendar. Every control gets a cadence — monthly, quarterly, or per-event — and a named owner. Evidence lands in a structured shared drive as it is produced, dated inside the period. This calendar is the engine of the whole route. SOC 2 evidence collection covers what each artifact looks like.
• 5. CPA examination. An independent, US-licensed CPA firm — readiness consultant and auditor must be independent of each other — examines the controls and evidence and issues the report. Who can perform a SOC 2 audit covers how to verify the signing firm.

For a Type II, stage four is most of the elapsed time: the controls simply operate across a 3-12 month observation window while evidence accumulates. No route — platform or not — compresses that window, because it runs in real time.

What replaces each platform function

A compliance platform is a bundle of conveniences, and each one has a plain equivalent built from things you already run. Our sibling guide to what SOC 2 automation actually automates takes the bundle apart in detail. This table is the working substitution map.

Notice what is absent from the right-hand column: anything you would need to buy. The substitutions are organizational, not technical — which is exactly why the honest cost of this route is measured in discipline, not dollars. Whether that trade suits your team is the real question, and our guide to whether you need SOC 2 software works through it.

What it costs and how long it takes — same standard, fewer invoices

The examination sets the calendar on every route, so going platform-free does not slow you down — it removes a line item. Sprinto’s published claim that manual preparation takes 3-6 months versus weeks with automation compares software against an unassisted internal team. A consultant who has run readiness hundreds of times compresses the same phase without a subscription.

For scale: Sprinto’s published 2026 cost guide prices platform subscriptions at $4,000–$30,000 per year by headcount, with platform-plus-partner-network audit totals of roughly $6,000–$60,000 under 500 employees — the audit is always billed on top of the subscription. Why the same report spans such different numbers is a structural story we tell in full in why SOC 2 quotes vary so much, and the SOC 2 cost guide breaks down the India-delivered engagement line by line. For the platform routes’ full multi-year arithmetic, see SOC 2 total cost of ownership.

This route, delivered: what we charge

This is the engagement we run: gap assessment, control design, policies, the evidence calendar, quarterly check-ins, and the attestation coordinated through independent, US-licensed CPA firms — no platform licence anywhere in the stack, working with the tooling you already have. Indicatively $2,500–$5,000 for a Type 1 and $3,000–$10,000 for a Type 2, all-in, fixed before we start. The full framework picture lives at our SOC 2 service page.

Serving clients across India, USA, UK, Australia & UAE. Final pricing depends on your Trust Services Criteria, stack, and entity structure — the scoping call is where indicative becomes exact.