Time savings estimate
How much audit time Lockstep saves.
A SOC 2 engagement run on spreadsheets and email spends a large share of its hours on chasing, filing and retyping, on both sides of the audit. This model estimates how many of those hours Lockstep removes for the auditor and for the client, activity by activity, and shows the reasoning behind each number.
- Modeled estimate
- October 2026
- Baseline: SOC 2 Type 2 engagement
Auditor hours
Client hours
What “manual” means here: an Excel request tracker, evidence requested and returned by email, files kept on a shared drive, test work in spreadsheets, and the report assembled by hand in Word.
The model
Where the hours go, and how many Lockstep removes.
Each row is a share of a manual engagement’s auditor hours. The reduction is how much of that activity Lockstep removes, and points saved is share × reduction, so the rows add up to the total. Open any row’s Details to see the manual work it replaces and why the reduction holds up.
Planning and setup12% of auditor hours25–40% less3.0–4.8 pts
Manual work it replaces
- Building the control matrix in Excel
- Writing the request (PBC) list from scratch or from last year’s copy
- Rebuilding the test program
With Lockstep
- Control import from a client-specific Excel template, checked before anything is saved
- Bulk request import with assignees, controls and opening notes
- Test step import
- One control library reused across all frameworks
- ISO 27001 engagements built from the client’s Statement of Applicability
- Recurring years: roll forward copies controls, test steps and requests into the new period
Imports replace row-by-row entry, and checking files before anything is saved removes cleanup rounds. In a recurring year, roll forward turns setup into review, which is why the recurring range is much higher.
Request tracking and follow-up15% of auditor hours40–60% less6.0–9.0 pts
Manual work it replaces
- Sending requests by email
- Updating the tracker by hand
- Writing chase emails
- Answering “what’s still open?”
With Lockstep
- One request maps to many controls and engagements, so the client is asked once
- Status workflow: Open, Under Review, Needs Changes, Completed
- Automatic due-date reminders, combined into one email per person
- Notifications that link straight to the request
- Bulk status and assignment changes
- Live progress dashboards per engagement and across clients
- AI-drafted request wording and suggested controls
This is the most clerical part of the audit and where the email problem is worst. Users of a comparable request portal reported cutting time spent managing the request list in half on large audits, which sets the top of the range.
Evidence intake and first review15% of auditor hours25–45% less3.8–6.8 pts
Manual work it replaces
- Saving attachments and renaming files
- Filing into shared drive folders
- Opening each file to check it answers the request
- Emailing back for missing pieces
With Lockstep
- Uploads land on the request automatically
- In-browser preview and one-click zip download
- AI evidence review: whether the file satisfies the request, and which other controls it could support
- Send-backs and replies stay in the request thread
Only 36% of requests are right the first time, so most go round at least twice. Lockstep makes each round cheaper and flags gaps sooner. The auditor still judges every file, which caps the range.
Control testing and workpapers30% of auditor hours10–25% less3.0–7.5 pts
Manual work it replaces
- Writing test procedures
- Recording results in spreadsheets
- Cross-referencing evidence files
- Repeating the same test for related controls
With Lockstep
- AI-drafted test step descriptions and tests of operating effectiveness
- One test step linked to several controls
- In-browser editing, PDF annotation, notes and version history
- Real-time shared audit sheet, with no locked file
Inspecting samples and forming conclusions is judgment work that software doesn’t speed up much. Savings come from drafting, cross-referencing and reuse, so this activity gets the lowest range in the model.
Review and sign-off10% of auditor hours10–25% less1.0–2.5 pts
Manual work it replaces
- Hunting for the evidence behind each test
- Review notes sent by email
- Rechecking work when evidence changes
With Lockstep
- Preparer and reviewer sign-offs on each control
- Sign-offs flagged as stale when the evidence behind them changes
- Comments on the test step itself
- Evidence, test and result in one view
Reviewers save time locating work and avoid late rework from changed evidence. The review judgment itself is unchanged.
Team coordination6% of auditor hours40–60% less2.4–3.6 pts
Manual work it replaces
- Internal email threads
- Status meetings
- Asking “where is that file?”
With Lockstep
- Engagement conversation with @mentions
- Dashboards in place of status check-ins
- Every file and comment stored on its request or test step
Knowledge workers spend 28% of the week on email and 19% searching for information. With everything in one place, most of that searching goes away.
Reporting10% of auditor hours35–60% less3.5–6.0 pts
Manual work it replaces
- Retyping control descriptions and test results into Word tables
- Writing the system description
With Lockstep
- Report generated into the firm’s own Word template
- Framework-aware fields: SOC 2 criteria, SOC 1 control objectives, ISO clauses and Annex A
- AI fills system components from meeting notes
- Excel exports for the firm and for the client
Retyping is pure clerical work and a common source of report errors. Narrative writing and final formatting stay manual, which keeps the range below the clerical activities.
Close-out and archive2% of auditor hours50–70% less1.0–1.4 pts
Manual work it replaces
- Completeness sweep across the tracker, folders and email
- Archiving folders
- Copying files forward for next year
With Lockstep
- Readiness checks for open sign-offs and unfinished work
- One-click archive that freezes the engagement, with comments still allowed
- Roll forward to the next period
A small share of hours, but almost entirely clerical.
Shares of hours are typical-engagement assumptions, not measurements. Swap in the split from one of your own past audits and the total moves with it.
The client’s side
Client hours Lockstep removes.
The model above counts auditor hours only. The client spends its own hours on the same engagement. These rows count client hours only and are never added to the auditor total.
Clients still read every control, just not in a spreadsheet. Management owns the controls, so someone on the client side should review each one. In Lockstep, client users see every control in the engagement on the audit sheet, with its mapped criteria inline and the requests behind it. There is one live copy instead of emailed versions. The auditor can add a client-editable column, such as “Management comments”, so feedback lands on the control itself.
Reviewing the control set12% of client hours20–40% less2.4–4.8 pts
Manual work it replaces
- Reading the control matrix as a wide spreadsheet
- Cross-referencing mapping tabs to see which criteria each control covers
- Marking up a copy and emailing it back
- Merging comments when several people review
With Lockstep
- Every control in the engagement on the audit sheet, with its mapped criteria inline
- The requests behind each control, visible on the same sheet
- One live copy, so nobody merges versions
- Feedback in a client-editable column the auditor adds, such as “Management comments”
Management owns the controls, so someone on the client side should read every one. Reading takes the same time either way. The savings come from dropping the cross-referencing, the marked-up copies and the merge, which caps the range.
Working out what’s being asked10% of client hours10–25% less1.0–2.5 pts
Manual work it replaces
- Reading the full request list to find your own rows
- Decoding terse request wording
- Emailing the auditor to clarify
With Lockstep
- Client members see only the requests assigned to them
- Each request carries its own description and comment thread
- Questions asked and answered on the request itself
Assigned requests cut the reading to each person’s own share, and questions stay with the request. An owner column and email do part of this in a spreadsheet, so the range stays low.
Pulling evidence from systems40% of client hours0–5% less0.0–2.0 pts
Manual work it replaces
- Running exports and reports
- Taking screenshots of settings
- Finding policies and signed documents
With Lockstep
- One request serves several controls, so the same evidence isn’t pulled twice
This is the largest block of client time, and Lockstep doesn’t connect to the client’s systems. Only duplicate requests go away, and a careful auditor avoids those in a spreadsheet too, so this row gets the lowest range in the model.
Sending evidence and tracking what’s open13% of client hours40–60% less5.2–7.8 pts
Manual work it replaces
- Attaching files to email, and splitting ones that are too large
- Naming files so the auditor can match them
- Keeping a private list of what’s still open
- Asking “did you get it?”
With Lockstep
- Upload straight onto the request, several files at once
- Status on every request: Open, Under Review, Needs Changes, Completed
- A dashboard listing the client’s own requests and their status
- One combined reminder email the day before requests are due
This is clerical work, and where a portal helps the client most. The reminder fires only before the due date, so overdue items still need a nudge from the auditor.
Rework after send-backs12% of client hours5–15% less0.6–1.8 pts
Manual work it replaces
- Finding the auditor’s feedback in an email thread
- Re-sending the corrected file
- Re-explaining context when the reviewer changes
With Lockstep
- Needs Changes status, with the reason in the request’s thread
- Notifications that link straight to the request
- Every file and comment kept on the request
Only 36% of requests are right the first time, and Lockstep doesn’t change that rate on the client side. It saves finding the feedback and resending the file. Redoing the evidence itself is most of the rework, and that doesn’t change.
Routing requests inside the client team8% of client hours40–60% less3.2–4.8 pts
Manual work it replaces
- Forwarding requests to the people who own each system
- Chasing colleagues for their pieces
- Collecting files and passing them on
With Lockstep
- Client admins reassign requests to colleagues, who are notified directly
- Colleagues upload straight to the request
- Client admins see every request for their company
With email, the client’s coordinator relays every file. Assigning the request to the person who has the evidence removes the relay.
Status calls with the auditor5% of client hours20–40% less1.0–2.0 pts
Manual work it replaces
- Weekly calls that walk the tracker line by line
- Preparing status updates
With Lockstep
- Both sides see the same status on every request
- Questions settled in request comments between calls
Calls still happen, but they cover exceptions instead of the whole list.
Pulling evidence out of the client’s own systems is the largest block of client time, and Lockstep barely changes it. That keeps the client total below the auditor total. First-year and recurring engagements are modeled the same on the client side.
The cost of the manual way
Why spreadsheets and email leak hours.
of client document requests are fulfilled correctly on the first submission. Most requests need at least one more round trip.
of audits run over their budgeted hours, and 25% miss their realization targets.
of a knowledge worker’s week goes to email, and to searching for and gathering information.
of real-world spreadsheets contain significant errors. A request tracker is a spreadsheet many people edit under deadline.
What goes wrong without a shared system
- Progress lives in inboxes.The answer to “what’s still outstanding?” depends on who sent the email.
- The tracker drifts.The spreadsheet says “received” while the file sits unopened in someone’s inbox.
- Clients get asked twice.Two controls that need the same evidence turn into two requests.
- Clients review controls in a workbook.The control matrix arrives as a wide spreadsheet with mapping tabs, and feedback comes back as a marked-up copy.
- Versions multiply.“Access review_final_v3_JB.xlsx” and its siblings each need checking.
- Turnover erases context.When a senior rolls off mid-engagement, their email threads leave with them.
- Sign-offs go stale silently.Evidence replaced after review isn’t caught until partner review, or later.
- Every year starts from scratch.Last year’s tracker, test program and report tables are copied and rebuilt by hand.
- The report is retyped.Control descriptions and test results are copied cell by cell into Word tables.
AI assistance
Where AI saves time, and where it doesn’t.
What the research shows
In a controlled study of 453 professionals, generative AI cut the time for workplace writing tasks by 40% and raised quality by 18%. A field experiment with 758 management consultants found tasks finished 25% faster with AI.
How this model uses it
AI speeds up drafting: request wording, test procedures, system components and a first read of uploaded evidence. Drafting is only part of each activity, so the model credits a fraction of those study results, never the full 25–40%.
The auditor stays in charge. Every AI suggestion is a draft the auditor accepts, edits or dismisses. AI never signs off a control, never marks evidence as sufficient, and never replaces professional judgment.
AI features in Lockstep
- Request titles and descriptions drafted from context
- Suggested controls for each request, so one request serves several controls
- Evidence review: whether an uploaded document satisfies the request, and which other controls it could support
- Test step descriptions and tests of operating effectiveness drafted per control
- System components for the report’s system description, filled in from unstructured meeting notes
- Next-step suggestions, such as importing controls or adding a missing test step
Your numbers
Estimate your own savings.
The inputs start with example values. Replace them with your firm’s figures.
Beyond hours
Gains the model doesn’t count.
- Client experienceOne portal, one place to review the controls, and one combined reminder email instead of scattered chases. Client hours are modeled above; how much easier the audit feels is not.
- Shorter calendar timeDue-date reminders and a visible status on every request cut the waiting between rounds. Elapsed weeks are left out of the hours model.
- Review qualitySign-offs are flagged when the evidence behind them changes, and archived engagements are frozen for peer review.
- ContinuityEvery request, file, comment and sign-off lives on the engagement, so a staff change mid-audit doesn’t lose history.
Method
Assumptions
- This is a modeled estimate built from published research and Lockstep’s feature set. It has not yet been measured on customer engagements.
- The baseline is one SOC 2 Type 2 engagement run with an Excel tracker, email, a shared drive and Word. The split of hours across activities is a typical-engagement assumption.
- The 200-hour example matches published fees. 200 hours at a blended rate near $200 is about $40,000, inside the $20,000–$50,000 range commonly quoted for a SOC 2 Type 2 audit.
- Reduction ranges are lower where professional judgment dominates (testing, review) and higher where the work is clerical (tracking, filing, retyping).
- Recurring engagements differ only in planning and setup, where roll forward copies controls, test steps and requests into the new period.
- Published billing ranges: staff $75–175, senior $125–225 and manager $175–300 per hour. Firms commonly set billing rates at 2.5–3.5 times loaded cost. A Senior IT Auditor’s national salary midpoint is about $115,000, roughly $85 an hour once benefits and overhead are added.
- Client hours are modeled separately and never added to auditor hours. Calendar time and quality improvements are excluded.
- The client model covers the audit itself, not readiness work such as writing policies or designing controls. The 150-hour client effort and the split of client hours are assumptions.
Sources for the research and figures on this page are available on request: sales@getlockstep.io.