How to Navigate Your SOC and ISO Compliance Post-Merger or Acquisition

Organizations complete mergers and acquisitions (M&A) all the time, be it for growth and expansion, to further synergize or diversify, or for other incentives. And as varied as your reason(s) may be for your latest realignment, there is one consistent impact M&A has no matter the driver—the effect on your ongoing compliance cycles. As such, you need to have a plan to properly adjust, especially since there are different paths you can take when accommodating such an organizational shift. 

As long-time compliance assessors and cybersecurity experts, we know that these complications—amidst everything else you have going on with M&A on top of normal business operations—can seem daunting. So, let us simplify it for you by giving you a place to start and some insight. 

In this blog post, we’ll take a look at your options regarding two of the most common security and compliance audits and certifications—we’ll provide the pros and cons to separate SOC 2 reports/ISO certifications and consolidated ones so that as you make business decisions moving forward, you will have a foundation for how to adjust your compliance initiatives as necessary. 

Options for How to Adjust Your SOC 2 Reporting After a Merger or Acquisition  

If you’re currently in the midst of a SOC 2 reporting cycle and are also making an acquisition, here are your two options for dealing with the new business in your SOC 2 examination. 

1. Perform Separate Audits/Reports  

Of course, the most obvious path is to just perform a separate audit—one for your established, scoped services/products, and then add another to assess those you’ve acquired, which means you end up with separate reports by product or service. 

Two reports may seem less than ideal, but you should note that it may be possible to consolidate certain entity-level controls—meaning that if your established report and that of your acquisition share them, they can be tested once but reused in those separate reports. You could even choose to carve those out within a central/enterprise SOC 2 report instead, but here are some more pros (and cons) of investing in another SOC report for your acquisition: 

2. Consolidate Your Acquired Business into Your Existing SOC Report

On the other hand, you could instead perform a single consolidated audit and generate a consolidated SOC report—one that encompasses your established scope and that of your new business.  

Here are the advantages and disadvantages of this route: 

Should You Perform a Separate SOC 2 Examination for Your Acquired Business or Consolidate?  

So then, how should you approach your SOC 2 reporting post-merger? 

Separate SOC 2 reports would better suit organizations that: 

• Serve different customer bases  
• Have SOC 2 review periods that are unalterable 
• Would need to scope different Trust Services Categories (TSCs) due to the varying relevance of TSCs to the separate systems, controls and processes 
• Have different customer commitments regarding the SOC 2 TSCs 

Whereas taking a consolidated approach would make sense for those organizations that have: 

• Overlapping or similar customer bases 
• Consolidated entity level controls (e.g., consolidated onboarding, offboarding, and performance evaluation processes, consolidated/global policies, consolidated risk assessment programs)  
• Consolidated people and processes (e.g., consolidated HR and/or compliance teams, a unified control set).  Even if infrastructure and systems differ, use of a single control set can allow for a consolidated report and samples to be used to test the differing systems or teams. 

Options for How to Adjust Your ISO Certification After a Merger/Acquisition 

Maybe you’ve invested in SOC 2 and an ISO certification, or maybe you’ve only opted for the latter. Whatever the case, here’s a deeper look at separate certifications or consolidation post-merger. 

1. Achieve Separate ISO Certifications

As with the SOC 2 reports, you can perform separate certification audits—one for your established services/products and one for the new ones under your organizational umbrella so that you end up with separate reports and certificates by product or service. 

Here are the pros and cons of separate ISO certifications: 

2. Consolidate Your Acquired Business into Your Existing ISO Certification

Alternatively, you may want to perform a single, consolidated audit and generate a consolidated report and certificate, and here are the advantages and disadvantages of such a choice: 

Should You Perform a Separate ISO Certification for Your Acquired Business or Consolidate?  

So again, which direction should your organization go? 

Keeping your ISO certifications separate would make the most sense if: 

• Both you and the entity you’re acquiring or merging with maintained your own ISO certifications prior to the M&A event 
• Customers dictate separate certifications 
• Both you and the entity you’re acquiring will remain separate legal entities for some period of time following the M&A event 

However, you could choose to consolidate your ISO certifications and stand to benefit if you’re well-resourced and as such, are already prepared to merge management systems (i.e., you have a single mature management system in place that can be expanded to include the new products, services, entity, etc.).   

If your organization decides to consolidate management systems and ultimately produce a single ISO certificate, you should review both management systems to determine which system is most mature (this is not just based on the original issuance date, but the program overall), the certificate review cycles and timing of the programs, and which program is best suited for expansion.  Scope expansion reviews can be used during surveillance or recertification cycles or can be performed off-cycle to expand the certificate that is determined by management to be the most mature and the best suited for expansion to incorporate the larger consolidated scope.  You should work with your ISO certification body (or bodies) to help roadmap the solution that is best for your organization.  

Moving Forward with Harmonious M&A and Compliance 

When it comes to SOC 2 examinations and ISO certifications and the impact of a new acquisition, the pros and cons of adjusting your compliance to add separate reports or consolidate them are incredibly similar. But, as we’ve noted, there are key indicators that could help you decide which way to go as you move forward with expanding your business and maintaining compliance, whether it’s with SOC 2 criteria or an ISO framework. 

You should also take care to consider the security risks that you open yourself up to when merging and acquiring, and if you’re interested in learning more about how you can mitigate those—or how we can help you with your existing SOC 2 reports and ISO certifications—contact us today.