From the first lead to the renewed certificate, we know how your firm runs.
SOC reports, ISO/IEC 27001 and ISO/IEC 42001 certification, CMMC assessments and the frameworks beside them all draw on the same pipeline, the same people and the same calendar. We bring your data together, show your leadership what it is saying, and help you act on it sooner.
Your systems are sound. The gaps between them have become your process.
Most firms have invested in capable systems, each chosen for a specific job. Without integration, each system's way of working becomes the firm's way of working, limitations included.
Information that does not flow between systems has to be carried by people. Over time that work settles into spreadsheets, shared folders and inboxes, and quietly adds cost at every handoff.
Tribal knowledge is the asset most firms do not protect. It is built over years and rarely written down. When an experienced person moves on, it moves on with them, and it cannot be rebuilt from systems it was never in.
Where the work tends to live
- Spreadsheetsone for each gap between two systems
- Shared foldersseveral versions, and no certainty which is current
- Emailapprovals and decisions that never reach a system
- Manual entrythe same information keyed in more than once
- Tribal knowledgewhat experienced people know and never wrote down
Eight places where time and revenue leave the firm
None of these is a failure of people. Each is what happens when systems do not share information.
Scope that never becomes data
Out-of-scope work goes unbilled, and the next cycle is priced without the facts.
Demand that is not forecast
Peaks surface in the season, with work declined or resourced late.
Staffing by memory
Qualification and independence are hard to evidence; reviewers are double-booked.
Dates set before readiness
Teams wait on clients, plans are reworked, and report dates move.
Budgets seen only at billing
Over-runs surface as write-downs, too late to act on.
Information re-keyed
Hours every week, spread across the team, that nobody measures.
Review as the bottleneck
Deliverables wait at the final step, and senior people absorb the delay.
A cycle that does not learn
Each renewal carries forward the last cycle's losses.
Sixteen steps from the first conversation to the next cycle. We know each one.
Whichever framework an engagement serves, it follows the same path through the firm. At most steps there is a handoff where time and value can slip.
Win the work
- Lead and enquiryFramework, scope and urgency, often held as notes
- ScopingSystems, locations and readiness, usually agreed in prose
- Conflict, independence and acceptanceChecks that must be evidenced
- Pricing and proposalThe budget that decides margin is set here
Contract and plan
- Engagement letter or contractScope, exclusions and fees agreed
- Client paperworkAgreements, questionnaires and applications
- OnboardingContacts, access and kickoff, often once per framework
- Planning and staffingQualified people for each framework, one calendar
Assess
- Readiness and requestsMuch of the same evidence, asked for more than once
- Evidence collectionFiles move between tools; context does not always follow
- Fieldwork and testingEach framework with its own templates
- Findings and remediationExceptions, nonconformities and plans of action
Report, bill and renew
- Review and the decisionEssential, and the scarcest resource
- Report, certificate or resultIssued; its scope and expiry start the next cycle
- Time, billing and collectionWhere earlier gaps become visible
- Surveillance and renewalKnown well in advance, rarely planned from it
Several frameworks, one firm, one set of people
Clients increasingly buy more than one: a SOC 2 report, then ISO/IEC 27001, then ISO/IEC 42001 as they adopt AI, and CMMC where they serve defence.
| Framework | What the firm issues | How the cycle runs |
|---|---|---|
| SOC 1 and SOC 2 | An attestation report, Type 1 or Type 2 | A report period, renewed each period |
| ISO/IEC 27001 | A certificate for an information security management system | Certification audit, surveillance audits, recertification |
| ISO/IEC 42001 | A certificate for an AI management system | The same certification cycle, applied to AI governance |
| CMMC | An assessment result for a defence supplier | Assessment, plan of action close-out, annual affirmation, reassessment |
| PCI DSS, HITRUST, FedRAMP, HIPAA | Each its own report or attestation | Each its own cycle and qualified people |
Much of the same evidence serves several frameworks. Firms that see the overlap serve a client once, not once per framework.
Clarity on what your data is saying, and where to act first.
We bring your data together in a data lake, or work with the one you already have, and give your leadership a clear view of the firm. We begin with a diagnostic and add focused modules from there.
Data insight diagnostic
Where every engagement with us begins
- How far your data sources can be trusted
- The headline findings on what your data says today
- What cannot be answered yet, and why
- A prioritised view of what to address first
Pipeline
What is coming, and whether you can deliver it
- Pipeline by framework, service line and partner
- Win rates, and where proposals stall
- Forecast confidence
- The demand it will place on your people
Portfolio
Which work creates value
- Revenue and margin by client and framework
- Engagement health against budget and dates
- Client concentration and retention
- The renewal and recertification calendar
Capacity
The right people, at the right time
- Utilization by level, team and qualification
- Capacity against forecast demand
- Early warning of over-allocation
- Hiring and subcontracting needs ahead
White space
Growth from the clients you already serve
- Clients with one framework but not the next
- Cross-sell opportunities, ranked by value
- Underserved segments and regions
- A prioritised list for partners
Once built, run it yourselves with a full handover, or keep us alongside month to month.
Principles your partners can rely on
Every month the gaps remain open has a cost.
There are two ways to close them: build a team and wait while it learns how your firm works, or work with people who already know the process from the first lead to the renewal.
How we work: in phases, beginning with your data
The data insight diagnostic
A clear view of your firm today, and what to address first.
Your first insight module
Working dashboards, validated with your partners.
Extend, connect and hand over
The remaining modules, and what your people know captured in one shared record.
Each phase stands on its own and ends in something your firm keeps. You decide after each one whether to continue.
Building a team, compared with working with specialists
- Recruit 2–4 months
- Ramp up and learn the firm 3–6 months
- Discover the gaps 2–4 months
- Build and connect 3–6 months
- Diagnostic 2–3 weeks
- First module 2–4 weeks
- Extend and hand over 4–8 weeks
Indicative ranges; every firm is different. A new team also carries salaries from its first day.
Why not hire?
Hiring can look more economical. This work calls for four distinct skills, and one person rarely brings more than one or two.
- Data engineering
- Analytics
- Dashboard design
- Knowledge of CPA and assessment firms
The two work well together: we build the platform and prepare your analyst to run it, so you hire to operate rather than to construct.
| One new hire | SoftwareLogics | |
|---|---|---|
| First results | 6–9 months | 4–8 weeks |
| Skills covered | One or two of four | All four |
| Starting point | A blank page | An approach shaped by CPA and assessment firms |
| If someone moves on | Knowledge moves on too | Documented and supported |
What waiting costs your firm
Enter your own figures to see what waiting costs. Nothing you enter leaves this page.
Your results appear here as you type.
An estimate from your own figures. Combines realization lost and time spent re-keying; each path is costed at the middle of its indicative range and excludes salaries.
We have done this for an assessment firm.
A CPA firm whose practice includes assessing clients against security and compliance frameworks. Its name is withheld.
The situation
- Engagement records spread across separate systems, with no single source of truth
- Data initiatives that had started separately and did not connect
- No single place for leadership to look across the firm
What we put in place
- A data lake bringing the firm's records together as one source of truth
- An analytical layer to look across clients, engagements and frameworks
- One plan for its data and AI initiatives, with SoftwareLogics as AI strategist and AI product manager
For managing partners, CFOs, COOs and CTOs of CPA and assessment firms who sense that value is slipping and want to see where.
Ten questions worth asking your firm
If each can be answered from a system rather than a person, your firm is well served already.
- How many open opportunities do you hold by framework, and what will they ask of your people next quarter?
- Which clients are waiting on a signed agreement or form today?
- Does the system that holds time also hold the budget the partner priced?
- Where does next quarter's reviewer and lead-auditor load come from?
- How many engagements exceeded budget last year, and why?
- Where is the staffing plan, and who changed it last?
- How do you know an engagement will be late before the client does?
- Which reports and certificates fall due next year, and which have a team?
- How many spreadsheets does the firm rely on, and what does each carry?
- What did last year's actual hours change in this year's renewal price?
Questions partners often ask
We already have good platforms.
We work with them. The opportunity sits in the space none of them owns, between one system and the next.
Our people know how it works.
They do, and that knowledge deserves protecting. We help the firm keep it when people move on.
Is AI a risk in an engagement file?
Nothing we build tests a control or forms an opinion. Every AI output has a named human check, and your client data never trains a model.
What about independence?
The work stays on the firm's side of the line, and the boundary is agreed with your quality leadership first.
We could hire someone instead.
You can, and we can help them succeed. We build it, prepare your analyst to run it, and stay available as needed.
Book a call. See what your data is telling you.
A complimentary conversation about where value may be slipping in your firm, and what a first, analytical phase would look like. No obligation.