Disclosure: ByteChek approached us and asked if we wanted to collaborate on content creation. We wrote this article and will be joining them for a LinkedIn Live discussion about SOC 2 compliance.
Compliance is never easy, but there’s no shortage of vendors trying to make it easier these days.
ByteChek is another SOC 2 compliance software vendor , but they have a somewhat different offering compared to the rest of the market. While all of the vendors will provide a SaaS solution, their users will need to work with an unaffiliated auditing firm to actually complete the audit process. ByteChek breaks from this norm by providing both a SOC 2 SaaS solution and a complete SOC 2 audit for just one fee.
It works like this: a company looking to get compliant signs up with ByteChek (the SaaS company). The company proceeds to use ByteChek’s software much like they’d use any other software vendor: create and edit policies, connect services and upload data, self-check for evidence. When it’s audit time, ByteChek Assurance , a separate and independently owned CPA firm, serves as the auditor.
“For the customers, they sign up for the tool, work with the tool. And as a result of using the tool, they get the report,” said AJ Yawn, CEO and founder of ByteChek.software space, it’s nothing new in the world of general SOC 2 compliance – or the wider accounting world as a whole. SOC 2 under one roof” experience that ByteChek is aiming to achieve.
The infamous Enron Scandal was at least partially the result of the conflict of interest generated by the fact that Arthur Andersen, Enron’s accounting firm, provided both consulting and auditing services to the doomed company. Specifically, Arthur Andersen did over $50 million in services for Enron in one year alone – about 27% of the accounting firm’s total revenue in Houston.
However, there are lots of differences between that situation and the business these cybersecurity firms do.
Coalfire and A-LIGN collectively issue thousands of SOC 2 reports every year. ByteChek is a new player but is looking to do the same. Additionally, these consulting and audit contracts tend to be in the tens-of-thousands to hundreds-of-thousands range, as opposed to tens of millions of dollars. Each client will only account for a small percentage of business for these firms.
The comparatively low reward per contract is not worth the existential risk scandalous operation threatens. If a client wants to act shady, it’s far easier for these cybersecurity firms to simply end their contract.
Additionally, the American Institute of Certified Public Accountants (AICPA), which also provides the standards for SOC reports, provides guidance on the “Use of a Specialist.”
The AICPA says the following about using specialists for audit evidence:
The auditor has sole responsibility for the audit opinion expressed, and that responsibility is not reduced by the auditor’s use of the work of an auditor’s specialist. Nonetheless, if the auditor using the work of an auditor’s specialist, having followed this section, concludes that the work of that specialist is adequate for the auditor’s purposes, the auditor may accept that specialist’s findings or conclusions in the specialist’s field as appropriate audit evidence. (AU-C 620.3)
Auditor’s specialist – An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the auditor to assist the auditor in obtaining sufficient appropriate audit evidence. An auditor’s specialist may be either an auditor’s internal specialist (who is a partner or staff, including temporary staff, of the auditor’s firm or a network firm) or an auditor’s external specialist. (AU-C 620.06)
In plain English, the AICPA is saying:
The auditor is responsible for what the SOC 2 report says, but that auditors may use specialists to collect evidence.
A specialist could be at the same firm as the auditor, from a firm affiliated with the audit firm, or the specialist could be from a completely external/unrelated firm.
Ultimately, these provisions do allow for the type of relationships that ByteChek, Coalfire, and A-LIGN provide.
Yawn is a retired U.S. Army Captain. After six years of armed service, he landed his first civilian job at Coalfire where he worked his way up to being a principal at the company. His experiences at Coalfire now help guide the direction of ByteChek.
AJ Yawn, Founder and CEO of ByteChek “I saw the full lifecycle of what went into the audit and saw what customers look for when going into audits,” said Yawn. “I realized they don’t like them, they don’t like the experience … I realized at Coalfire there’s some fat we can trim, and I also realized we can use software to automate things.”
Once a customer reaches about 80% SOC 2 readiness, they meet with ByteChek Assurance to begin the audit process. Obviously, all evidence is reviewed and handled through the ByteChek platform, similar to how most other SOC 2 compliance software vendors have built-in audit workflows.
In March 2021, ByteChek was selected by the AICPA for their Startup Accelerator program and received $25,000 in funding. Yawn founded ByteChek in 2020 and currently has about 9 employees.
Stay tuned for a LinkedIn Live discussion between AJ Yawn and Fractional CISO’s founder, Rob Black!
Want to get great cybersecurity content delivered to your inbox? Click here to sign up for our monthly newsletter, Tales from the Click.
