Practical thinking on compliance, controls, AI and independent assurance for the decisions that matter to your company.
What do we need, and how should we approach it?
Readiness, Type 1 versus Type 2, scope, timelines, budgets, combining frameworks, sequencing work, annual renewals.
What should our controls look like for the way we operate?
Risk management, vendors, people security, access, change management, incident response, resilience, evidence, proportionality.
How can AI build, coordinate, and operate our program?
The three stages, context, Compliance Brain, permissions, human oversight, platforms, agent-produced evidence.
How do we choose an auditor and get a credible, useful result?
Firm credentials, audit quality, auditor selection, switching firms, audit procedures, report findings, enterprise due diligence.
Enduring guides for common compliance decisions.
What readiness should cover, when to involve your auditor, which gaps matter most, and how readiness, Type 1 and Type 2 can work as one continuous engagement. A practical guide to preparing for a report your customers can rely on.
Compliance Shapes are the 20–30 consequential design decisions that determine how a company’s risks, controls, policies, evidence and compliance program should work.
AI can be your compliance manager, but a human still needs to be the compliance leader. How agentic compliance works, what it changes, and where accountability stays.
CPA firm registration, signing licenses and peer review are the starting point, not proof of quality. A practical guide to checking credentials and asking the questions that matter before choosing your SOC 2 auditor.
Recent articles and observations from our practitioners.
ISO 42001 isn't yet an enterprise requirement. What it covers, how it compares with SOC 2 and AIUC-1, and when it's worth it for an AI company.
By Paul WenhamSOC 2 for AI-native companies: simpler stacks, agents running the program in your own tools, concise policies, and a report that covers AI in production.
By Paul WenhamAustralian companies need a SOC 2 report issued under the AICPA standards by a US-licensed CPA firm, delivered by a strong local team in Australian time zones. Here's how the provider options compare, and what to check.
By Paul WenhamExperienced CTOs don't choose a SOC 2 audit firm on price or speed. They look for tech stack expertise, a tailored approach, flexible scheduling, responsiveness and year-round partnership, because those factors decide how much time the audit really costs.
By Paul WenhamA practical guide to collecting SOC 2 and ISO 27001 evidence with AI: when to use connectors, when to use browser agents, when a human should act, and where audit evidence actually lives.
By Paul WenhamHow to cover production AI agents in SOC 2: governance, access, change management and monitoring, with indicative criteria mappings, customer responsibilities and practical audit expectations.
By Paul WenhamFive signals of real quality in assurance and security, with practical guidance on building a compliance program that supports customer TPRM, repeatable enterprise reviews and revenue growth.
By Paul WenhamCompliance from first principles, the 95% problem, the compliance metadata AI needs, rethinking screenshots, spreadsheets and policies, and why audits should meet clients where they are.
By Paul WenhamThe person leading your SOC 2 audit is the most underrated factor in choosing an audit firm. Companies compare price, timelines and platform integrations, then barely ask who will actually do the work.
By Paul WenhamEnterprise security teams review you in the background and rarely give feedback. What they look at beyond SOC 2, what counts as a genuine pen test, and how a quality report does the heavy lifting.
By Paul WenhamA category-by-category SOC 2 budget in USD, covering audit fees, readiness, platforms, penetration testing, consultants, internal assessments and operational costs. Learn what is required, what is optional, and what a quote can leave out.
By Paul WenhamSOC 2 is a risk report, not a certificate. Understand how enterprise customers use it, why having a report is only base camp, and how to turn your audit into a trust asset for growing revenue.
By Paul WenhamHow long a SOC 2 Type 2 observation period should be, how to work backwards from a customer deadline, when auditors test, why reports run late and how much buffer to build in.
By Paul WenhamWhat readiness should cover, when to involve your auditor, which gaps matter most, and how readiness, Type 1 and Type 2 can work as one continuous engagement. A practical guide to preparing for a report your customers can rely on.
By Paul WenhamWhat Security, Availability, Confidentiality, Processing Integrity and Privacy each cover, how often they're included, and how to decide which belong in your SOC 2 report.
By Paul WenhamWhich SOC 2 report should come first? Six client cases, practical decision tables and an illustrative 18-month cost comparison explain when to start with Type 1 and when to go straight to Type 2.
By Paul WenhamAudit quality isn't service quality, and it isn't only professional standards. The real test is whether a reader of your report thinks: this tells me what I need to know.
By Paul WenhamCPA firm registration, signing licenses and peer review are the starting point, not proof of quality. A practical guide to checking credentials and asking the questions that matter before choosing your SOC 2 auditor.
By Paul WenhamEnterprise buyers use SOC 2 as an initial qualifier, then look deeper. A quality report is what carries you through that assessment and turns your compliance investment into real trust.
By Paul WenhamA practical architecture for agentic compliance: give AI a role, company context, system visibility, skills, bounded authority, escalation rules and human leadership.
By Paul WenhamCompliance Shapes are the 20–30 consequential design decisions that determine how a company’s risks, controls, policies, evidence and compliance program should work.
By Paul WenhamAI can be your compliance manager, but a human still needs to be the compliance leader. How agentic compliance works, what it changes, and where accountability stays.
By Paul WenhamHow agentic compliance can reduce the need for a compliance platform, where platforms still add out-of-the-box value, and the question that matters: where do humans and AI do their teamwork?
By Paul WenhamWhat a Compliance Brain is, the Compliance Metadata it should contain, and how to give an AI agent enough company context to manage a compliance program.
By Paul WenhamWho can audit a SOC 2 or ISO 27001 program run by AI agents, what auditors test for agent access and oversight, and how to choose an auditor for agentic compliance.
By Paul WenhamThere's a basic psychology behind why most people don't like audits. Fix this, and people are surprisingly happy to do them again.
By Paul WenhamSOC 2 is the language trust speaks. When you understand that, the entire conversation changes.
By Rob McAdamNeither is better for everyone. The right choice depends on your customers, how you run security and where you are headed. For AI-native and AI-centric companies, SOC 2's flexible criteria usually make it the stronger starting point.
By Paul WenhamDiscuss your circumstances with a Throughline senior practitioner. A complimentary workshop to work through your goals, the decisions ahead and a practical path forward.