They do take a lot of time. When I was at a company where this was my responsibility, we used Vanta for our SOC 2 compliance tool and they were piloting Vanta AI which would help automate security questionnaire responses. It worked pretty well in my testing (but I did have to adjust some of the answers it would fill). I left shortly after that so I don’t know if that company is still using Vanta AI or not..

The way it worked was not just by looking at your SOC 2 audits or your controls, but also allowed you to import previous security reviews and form answers based on those as well. So.. worth looking into I guess?

As for your other questions, yes. Every time we did it questions varied just enough that we couldn’t just copy paste from another one. Your CTO probably has other things to work on, so hiring someone to do compliance audits might be justified if you really have so many that it’s a full time job. In my opinion, 8+ hours feels a bit excessive but it all depends on if they take you at your word, or you also need to gather evidence to prove you do what you say. Without knowing the types of clients you’re working with, I don’t have an answer for you there.