Reference / Scenario calculator

SOC 2 cost calculator.

Pick the inputs that match your context. The calculator returns a year-1 range, year 2 and 3 cost, three-year total, and the line-by-line breakdown. No email is captured. Print the result for a finance committee with the print stylesheet.

Scenario model

This site's model, GBP

This is a model, not a price list. Audit firms do not publish fees, so nothing below is a market rate. The hour and day counts are this site's assumptions; the rates are yours to set. Use it to test a quote you have been given, not to predict one.

Company sizeCurrent security maturityAudit typeTrust Services Criteria in scopeGRC platform contract (£/year, 0 for none)Enter what your quote or contract says. GRC vendors publish their list prices in US dollars on AWS Marketplace, and this model works in pounds, so it will not convert one into the other for you. The published dollar SKUs are on the GRC platforms page.Blended auditor rate (£/hour)Defaults to £190, which is our assumption and nothing more. If you have an engagement letter, divide the fee by the quoted hours and use that.Internal hourly cost (£, fully loaded)Readiness consultant day rate (£)

Year 1 modelled (audit, readiness, platform, internal time)

£50,700 – £93,600

Year 2 modelled (full re-audit, platform, reduced internal time)

£34,100 – £58,700

Two-year total

£84,700 – £152,200

How the year 1 number is built

Audit firm fee£24,700 – £41,800
130 to 220 auditor hours at £190/hr
Readiness£7,200 – £18,000
8 to 20 consultant days at £900/day
GRC platform (none)£0 – £0
No platform in this scenario
Internal time£18,800 – £33,800
250 to 450 hours at £75/hr

The model's assumptions: auditor hours and readiness days scale with company size; a Type 1 is assumed to take 60 percent of the Type 2 hours for the same scope, because it has no observation window and no sample testing; each optional Trust Services Criterion is assumed to add between 10 and 25 percent to auditor hours; year 2 repeats the audit in full, because SOC 2 has no surveillance audit.Every one of those is our assumption rather than an observed figure. They are set out in full, with the reasoning, on the methodology page.

How the model works

It works bottom-up. You describe the scope; the model assumes an hour or day count from it; you supply the rates; the total is the arithmetic of the two. Nothing is reverse-engineered from a headline figure, and every component shows the working that produced it.

Scope drives auditor hours: the size band sets a baseline, the audit type adjusts it (a Type 1 has no observation window and no sample testing, so it is assumed to take a fraction of the Type 2 hours), and each optional Trust Services Criterion widens it. Maturity is applied to readiness and internal time but never to the audit fee, because a mature programme does not make the auditor's testing cheaper. Year 2 repeats the audit in full, because SOC 2 has no surveillance audit.

The platform line is the exception, and it is the one part of a SOC 2 budget with real published prices behind it. The vendors list annual figures on AWS Marketplace in US dollars; this model works in pounds; so it asks you for your contract value rather than doing the exchange arithmetic and presenting the result as somebody's price. The published dollar SKUs are on the GRC platforms page.

Every hour count and factor above is this site's assumption, not an observed market figure. Audit firms publish no fees, so the output is a way to sanity-check a quote you have been given, never a market price. All the assumptions are listed, with the reasoning for each, on the methodology page.

Print and share

The calculator above prints cleanly. Use your browser's print function (Ctrl/Cmd P) to save the scenario as a PDF for a CFO conversation or a finance committee paper. The print stylesheet hides the navigation and footer.

No email gate, no signup, no exit-intent. The result is static when printed, with the input set visible at the top for reproducibility.

For the more detailed picker covering Type 1 vs Type 2 decisions specifically, see the Type 1 vs Type 2 page. For the per-criterion scope toggle, see the Trust Services Criteria page. For the GRC platform break-even calculator, see the GRC platforms page.