The Evidence Engine: nothing missing when fieldwork starts
A retainer that monitors operating effectiveness across your entire SOC 2 Type II window or ISO surveillance period, curates your evidence, and runs a mock fieldwork dry run, so your real audit holds no surprises.
SOC 2 Type II is won across the window, not on the last day
A Type II audit tests whether your controls operated effectively across a period, often three to twelve months. The single biggest cause of exceptions is not a missing control. It is a control that drifted, or evidence that was never captured cleanly while the period was running. By the time fieldwork starts, that gap is fixed in time and cannot be undone.
The Evidence Engine closes that gap by working across the whole window, not at the end of it.
What is included
- Operating-effectiveness monitoring across your full audit period.
- An evidence repository designed and curated with chain of custody, a fixed taxonomy, and period tagging.
- Monthly or quarterly evidence reviews with gap closure.
- A mock fieldwork dry run before your auditor arrives, so surprises happen on our watch.
- Direct liaison so your attestation auditor receives clean, complete, defensible artifacts.
Pull, then verify
Your GRC platform is the starting point, not the finish line. We pull from Vanta, Drata, or Sprinto and then human-verify every artifact, because the platform's green status is not what your auditor tests. This is the step automation skips, and the one that decides whether you get a clean opinion.
The point of a dry run is simple: every surprise should happen on our watch, never in front of your auditor.
Who it is for
Companies in an active SOC 2 Type II window, or running toward an ISO 27001 certification or surveillance audit, that cannot afford a qualified opinion or a delayed certificate. It pairs naturally with a Gap Sprint: assess first, then keep the evidence audit-ready through the window.
The Evidence Engine, answered
How much does the Evidence Engine cost?
The Evidence Engine retainer starts at $5,000 per month, or $15,000 to $28,000 per quarter, scoped to your environment and audit window. See pricing.
What is mock fieldwork?
A dry run of your audit before the real auditor arrives. We simulate the auditor's sampling and testing so any gaps surface while there is still time to fix them, instead of becoming exceptions in your report.
Can you work with our auditor?
Yes. We liaise directly with your attestation auditor or certification body and hand over a clean, period-tagged evidence package with a one-page evidence map, which makes their fieldwork faster and your result cleaner.
Does this replace our GRC platform?
No. It works alongside Vanta, Drata, or Sprinto. The platform collects; we verify and curate so your evidence holds up under real testing.
Book a discovery call
Tell us your framework and audit window. We will show you how the Evidence Engine keeps you ready through fieldwork.