Your compliance report is not a compliance program

Here is a sequence I've watched more times than I'd like. A company needs ISO 27001 or SOC 2 for a deal. It hires a firm. Three to six months later it receives a report and a folder of policies. The firm leaves. Within a year, the company is back where it started, except now it has a folder.

You should never pay for a compliance report on its own. You should pay for a program that keeps running without the people who built it, and judge the consultant on that alone.

I've inherited programs from other consultants, including third party ISO 27001 documentation I was brought in to repair, and the failure is always the same shape. The documents describe a company that doesn't exist.

Why reports win and programs lose

The consulting model pays for the deliverable. A report is countable, reviewable and invoiceable. A program that is still alive in month nine is none of those things at the time the invoice is raised.

So the deliverable gets polished and the operation gets ignored. Templates arrive with the wrong sector still in them. I've seen a privacy policy for a fintech that referred to "manufacturing processes", and an access control policy that required sign off from a Chief Information Security Officer at a nine person company. The CISO, presumably, was the policy itself.

What the standards actually expect you to keep doing

Certification is the start of the obligation. ISO 27001 requires you to perform risk assessments at planned intervals and when significant changes happen (clause 8.2), run internal audits (clause 9.2) and hold management reviews (clause 9.3). Your certification body comes back every year for a surveillance audit to check that you did.

SOC 2 Type II is even less forgiving. The auditor tests whether your controls operated across an observation period, usually three to twelve months. A control that worked in January and stopped in April is an exception in the report your customers read.

None of that happens because a document says it should. It happens because a person has it on their calendar.

What a real handover contains

A named owner for every recurring control. Teams don't own things; people do.

A calendar of what happens monthly, quarterly and annually: access reviews, vendor reviews, risk register updates, policy reviews, backup restore tests, the internal audit.

One place where evidence lives, with dates, so nobody reconstructs proof from Slack two weeks before the audit.

A way to see status without calling the consultant. This is where software belongs. Tools like Vanta, Drata, Sprinto and Steppe all exist because a shared drive cannot remind anyone of anything. We built Steppe from the consulting side, so the handover and the tool are the same thing: the program I set up is the program the client sees on Monday.

If your compliance folder's last edited date is the week the engagement ended, you already know which kind you bought.

Questions to ask your next consultant

Who will operate this when you leave, and have you met them? What will exist in six months that doesn't exist today? Which recurring activities will be scheduled, and where? Will you come back for the surveillance audit, and what does that cost?

A good consultant answers these without hesitating. A firm that only sells reports will change the subject to the deliverable.

Pay for the program, measure the consultant on whether it is still running a year later, and let the report be the least important thing they hand you.