What a SOC 2 report actually tells you about a technology provider, and why it matters for New Zealand organisations.
SOC 2 is an independent assessment framework developed by the AICPA, the professional body that sets auditing standards used around the world. Instead of a technology provider describing its own security, a qualified independent auditor examines how client systems and data are actually protected, then puts their name to the findings.
There are two levels. A Type 1 report says the right controls existed on a given day. A Type 2 report tests that those controls operated across months of normal business, which is why it is the harder and more meaningful of the two. When you see SOC 2 Type 2, someone independent has watched the controls work over time, not just read about them.
A SOC 2 report is built on the AICPA trust services criteria. Security is always assessed, and providers choose which further criteria they are examined against. The IT Works report covers three.
How systems are protected against unauthorised access, misuse and interference. This is the foundation every SOC 2 report is built on, covering everything from access controls to how changes are made and monitored.
Whether the systems clients rely on are actually there when needed. Availability looks at resilience, capacity, monitoring and how incidents are handled, so promised uptime is tested rather than assumed.
How information designated as confidential is protected through its whole life, from how it is stored and shared to how it is disposed of when no longer needed.
Your technology provider holds the keys to your systems: administrator access, remote tools and copies of your data. Their security posture is effectively part of yours, which is why boards, insurers, government agencies and larger clients increasingly ask for evidence rather than assurances. Working with an independently assessed provider means those questions arrive with an answer already prepared.
SOC 2 is voluntary in New Zealand, and that is exactly why it is useful. A provider cannot buy the report or self-declare it. The only way to hold one is to open the business to a qualified independent auditor and let the controls speak for themselves. It is one of the clearest signals available that a provider practises the cybersecurity standards it recommends.
IT Works completed a SOC 2 Type 2 assessment with Grant Thornton New Zealand covering Security, Availability and Confidentiality, with controls tested across six months of normal operation from January to June 2026. The controls we were examined against are the same ones we put around our clients, alongside the standards listed on our company facts page and the partnership approach described in how we work.
SOC is short for System and Organization Controls, a family of assessment frameworks from the AICPA. SOC 2 is the one designed for technology and service providers that hold or process client data, which is why it is the version that matters when you are choosing an IT partner.
It is the detailed document an independent auditor produces at the end of the assessment. It describes the provider’s systems, the controls in place, how each control was tested and what the auditor found. Reports are shared privately with clients and prospective clients rather than published, which is why ours is available on request below.
Only a licensed CPA firm can issue a SOC 2 report. Ours was performed by Grant Thornton New Zealand, so the opinion behind it carries the weight of an established international audit practice.
They are complementary rather than competing. ISO 27001 certifies that a security management system exists and is maintained. SOC 2 Type 2 reports on whether specific controls actually operated over a period of months. Many organisations value SOC 2 precisely because it tests practice rather than paperwork.
Our SOC 2 Type 2 report is shared with clients and prospective clients under a confidentiality agreement. Tell us who you are and we will be in touch within one business day to arrange it.
Ask us anything. We’ll give you an honest, jargon-free answer and a clear next step. No pitch, no pressure.
0800 448 967 or book a time below
