Connective cuts SOC 2 audits from 5 months to 5 weeks with Drata

Challenge 

• Manual SOC 2 prep ran through spreadsheets, SharePoint, calendar reminders, and emails, making evidence hard to manage and easy to miss.
• Audit preparation became an annual fire drill: a Trello board with ~500 cards and audits that took four to five months to complete.
• Limited control visibility created gaps: “We had no way to monitor our controls effectively,” and teams were often “back to square one” at audit time.

Solution 

• Implemented Drata to centralize SOC 2 evidence, assign control owners across HR, legal, compliance, and engineering, and track tasks in one place.
• Adopted daily monitoring using Drata’s dashboard so control owners can remediate immediately when readiness drops.
• Expanded beyond SOC 2 by managing additional frameworks in Drata, including the NIST AI RMF and Australia’s Essential Eight, while also centralizing the risk register, policy management, and vendor tracking.
• Published a Drata Trust Center to streamline recurring lender and partner audits and reduce repeat requests.

Impact Highlights

• 75% reduction in SOC 2 audit duration SOC 2 audits were reduced from four to five months down to just five weeks total, shifting audit prep from a prolonged annual disruption to a predictable, contained process.
• 2 hours to 100% Essential Eight readiness with cross-mapped controls By applying cross-mapped controls and daily dashboard checks, Connective reached “100 percent ready to go” for Essential Eight in just two hours.
• 30 seconds to respond to lender audit requests via Trust Center Lender and third-party audit requests dropped from approximately 2.5–3 hours of manual work to about 30 seconds by directing reviewers to Connective’s Trust Center instead.
• 2 months from kickoff to first audit using Drata Connective went from onboarding to its first SOC 2 audit in under two months, replacing a historically manual, months-long setup with a fast, execution-driven implementation.

Background

Connective Broker Services is an Australian mortgage aggregator that provides business support services and a CRM platform used by mortgage brokers to facilitate home loans and other finance options end to end. As a financial services company handling sensitive identity and financial information, maintaining customer and partner trust is foundational.

In 2022, Connective achieved its first SOC 2 attestation. But for the following two years, audit readiness was “manual,” “cumbersome,” and run through spreadsheets, file shares, and email, making it difficult to consistently monitor controls and assemble evidence when auditors arrived. As Ashley Jackson, Chief Information Officer, put it: “We treat data as hazardous material,” and the team needed a more reliable way to maintain trust and compliance day to day.

After a particularly exhausting audit cycle, Ashley searched for a better path. Drata provided a unified platform to maintain continuous readiness, centralize evidence, and scale ownership beyond a single person so the organization could stay audit-ready without the annual scramble.

Replacing annual SOC 2 fire drills with daily readiness

Before Drata, SOC 2 prep was a once-a-year sprint that relied on spreadsheets, SharePoint, and manual follow-ups. Evidence lived across emails and file shares, and it was easy for “the weeds” to grow when teams got busy.

With Drata, Connective moved to a daily operating rhythm. The team checks the dashboard every day, and when readiness drops, the responsible control owner investigates and remediates immediately. They’ve turned compliance into an ongoing practice instead of a yearly project, giving the business confidence that issues are identified and addressed long before an audit begins.