Appropriate scope
Objectives, criteria, responsibilities and boundaries are made clear before work starts.
What we do
Pick a service, find your industry, or start from what you are trying to get done.
Explore What we doBrowse What we do
View allProfit360™
Our way of turning your finance function into a source of profit.
Explore Profit360™Browse Profit360™
View allGlobal
A coordinated approach to cross-border finance, tax and assurance questions.
Explore GlobalBrowse Global
View allInsights
Tax changes, finance thinking and what they mean for your business.
Explore InsightsBrowse Insights
View allAbout
Who we are, who you will work with, and how we hold ourselves to account.
Explore AboutBrowse About
View allCareers
Build a career in US accounting, tax and advisory.
Explore CareersBrowse Careers
View allServices
Specialist work across compliance, assurance, finance and growth.
Explore ServicesBrowse Services
View all→SOC 2 auditExplore SOC 2 audit.→SOC 2 for startupsExplore SOC 2 for startups.→SOC 1 and SOC 2Explore SOC 1 and SOC 2.→ISO 27001 readinessExplore ISO 27001 readiness.→ISO readinessExplore ISO readiness.→US tax for international foundersExplore US tax for international founders.→Audit & AssuranceExplore Audit & Assurance.→TaxExplore Tax.→Accounting & FinanceExplore Accounting & Finance.→AdvisoryExplore Advisory.→ValuationExplore Valuation.→ESG & SustainabilityExplore ESG & Sustainability.
Audit & assurance
Confidence in the numbers—and the process behind them.
AT&F brings financial-statement audit, SOC, internal-audit and verification work into a disciplined engagement model: clear scope, structured evidence, active communication and appropriate quality review.
What good assurance feels like
A clear route from question to conclusion.
Evidence with a purpose
Requests relate to the agreed objective, relevant risks and procedures—not a generic document dump.
Communication that keeps moving
Owners, status, questions and key judgements are visible throughout the engagement.
How we work
A quality-led engagement process, translated for clients.
Our public approach reflects the same disciplines that underpin strong assurance work: client acceptance, planning, documentation, supervision, review and post-engagement learning. The precise procedures depend on the scope and applicable standards.
- 01
Confirm fit and independence
We establish the intended users, framework, responsibilities, timing and whether we can accept the engagement.
- 02
Plan around risk and evidence
The team maps the business, relevant systems, material areas, control environment and information needed.
- 03
Perform and communicate
Procedures, questions and judgement areas are managed through a clear request and communication rhythm.
- 04
Complete, report and learn
Work is reviewed, required communications are completed and improvements are captured for the next cycle.
For SOC engagements
Quality controls that make the work more dependable.
A SOC report should not be a document race. AT&F's documented method uses quality gates designed to keep scope, evidence, professional judgement and release decisions clear.
Client management remains responsible for its system, controls, description, assertion, remediation decisions and the evidence it provides. The exact report type, selected criteria, period and plan are agreed for each engagement.
- 01
Accept the right work
Before a SOC engagement proceeds, the proposed scope, system boundary, intended users, management cooperation, available evidence, independence, competence and capacity are evaluated. A completed questionnaire alone is not an acceptance decision.
- 02
Plan the evidence around the engagement
The engagement plan identifies the agreed scope, selected criteria, responsibilities, evidence approach, milestones, review points and escalation path. Standard materials guide the work; they do not replace professional judgement.
- 03
Supervise, challenge and escalate
Evidence is assessed critically. Significant exceptions, scope limitations, security incidents, unresolved contradictions and independence concerns are escalated rather than worked around.
- 04
Review before a report is released
Before report dating or release, the file, evidence, consultations, required reviews and management documentation are evaluated. An engagement quality review is completed when required by the engagement or quality-risk assessment.
- 05
Learn after the engagement
The final record is assembled in a controlled manner, and post-issuance inspection findings are used to identify any needed improvements in methodology, training, supervision or templates.
Our assurance services
Choose the work that matches your objective.
If you are unsure which route applies, start with the outcome and reporting requirement—not the service label.
SOC 2 audit
Type 1 and Type 2 examinations against the Trust Services Criteria your customers asked about.
Explore serviceSOC 2 for startups
A customer-trust path for teams whose next enterprise buyer is the reason SOC 2 came up.
Explore serviceISO readiness
AT&F helps with readiness and preparation for the certification audit of ISO 27001 and other standards. An accredited certification body issues the certificate, not AT&F.
Explore serviceISO 27001 readiness
AT&F helps with readiness and preparation for the certification audit of the information security management system. An accredited certification body issues the certificate, not AT&F.
Explore serviceSOC 1 and SOC 2
Choose the report, the system boundary, and the evidence plan before an examination is accepted.
Explore serviceFinancial statement audit
US GAAS financial-statement audit work for businesses that need an independent opinion.
Explore serviceInternal audit
Risk-based review and practical control insights for management and governance teams.
Explore serviceAsset verification
Defined verification procedures for assets, records and agreed reporting needs.
Explore serviceWhat to have ready
A focused first conversation saves time later.
- The reason assurance is needed and who will rely on the outcome
- Legal entities, reporting period and relevant framework
- A short description of operations, systems and key changes
- Key deadlines, stakeholders and existing adviser relationships
Before publication
Proof points will be added with permission.
Client names, outcome metrics, engagement examples, partner badges and testimonials remain intentionally unpublished until AT&F has approved evidence and permission to use them.
View the case-study frameworkStart a conversation
Let’s define the right assurance route.
We will start with your facts and determine the appropriate next step. No outcome is promised before scope and acceptance are confirmed.