PCI DSS v4.0.1 · ROC, AOC and SAQ
PCI Compliance Audits and PCI DSS Assessments
A PCI DSS audit, often called a PCI compliance audit or PCI assessment, is a Qualified Security Assessor’s check that your business protects cardholder data to PCI DSS v4.0.1, the standard your acquirer and the card brands require. As a PCI SSC-approved QSA company, we scope and test your environment, then sign your Report on Compliance (ROC), Attestation of Compliance (AOC) or QSA-validated SAQ.
Prefer to talk? Call +44 161 523 5276
- PCI SSC-approved QSA company
- Report on Compliance & AOC
- SAQ support for smaller merchants
Trusted by banks, payment providers and global brands
On this page
- What does a PCI compliance audit include?
- PCI assessment types: self-assessment (SAQ), QSA-validated SAQ or ROC
- Who completes and signs each type of PCI assessment?
- How long does a PCI audit take?
- PCI DSS audit timeline: from discovery call to AOC
- Why choose Sovereign Secure for your PCI audit?
- Frequently asked questions
Overview
What is a PCI compliance audit?
The short answer
A PCI compliance assessment, or PCI DSS audit, checks that your business meets PCI DSS v4.0.1 and ends in either a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ), summarised in a signed Attestation of Compliance (AOC). Level 1 merchants (over 6 million transactions a year) and Level 1 service providers (over 300,000) need a ROC from a QSA.
A PCI compliance audit tests whether the controls PCI DSS v4.0.1 requires are in place and working across your cardholder data environment (CDE), the people, processes and systems that store, process or transmit card data, and across the connected systems that can affect its security. The assessor reviews documents, interviews staff, samples systems and records, and observes processes, then records the result in a Report on Compliance (ROC) or a validated Self-Assessment Questionnaire (SAQ), summarised in an Attestation of Compliance (AOC).
Sovereign Secure is a PCI SSC-approved Qualified Security Assessor (QSA) company headquartered in Accrington, Lancashire. You can check us on the PCI SSC list of Qualified Security Assessor companies, and we are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. We take you from the first scoping workshop to a signed Report on Compliance, so there are no surprises on audit day. What a QSA does, and how to verify one, is explained on our PCI QSA page.
The Payment Card Industry Data Security Standard (PCI DSS) applies to every organisation that stores, processes or transmits cardholder data, or that can affect the security of that data. Version 4.0.1 is the current standard, and every future-dated requirement introduced in v4.0 has been mandatory since 31 March 2025.
PCI DSS contains around 250 detailed requirements under its 12 principal requirements. Most of the cost of compliance comes from getting scope wrong: systems that never needed to be in the cardholder data environment end up being assessed. We start by pinning scope down, then help you reduce it through segmentation, tokenisation and outsourcing before a single control is tested.
Whether you are a Level 1 merchant or service provider that needs a full Report on Compliance (ROC), or a smaller business completing a Self-Assessment Questionnaire (SAQ), our assessors give you a clear answer on what you need to do, and why. Not sure where you sit? Our guide to PCI compliance levels sets out the Visa and Mastercard thresholds.
PCI DSS audits for service providers. If you store, process or transmit card data for other businesses, or can affect its security, you validate with a ROC or SAQ D for Service Providers and give your merchant customers an AOC for Service Providers. Service provider levels, the extra requirements and the responsibility matrix customers ask for are covered on our PCI compliance service provider page.
What drives the price of a PCI audit. Price follows scope: how many payment channels, locations and systems sit in your cardholder data environment, whether segmentation is in place and tested, how many third parties are involved, whether you need a ROC or an SAQ, and whether this is your first assessment or a renewal. We quote a fixed price after a short scoping call, and our PCI DSS compliance cost guide explains each factor.
Need to get ready first? If you are not yet confident you would pass, start with PCI DSS consultancy: scoping, gap analysis and remediation support before the formal audit. Our free PCI DSS compliance checklist lists the evidence assessors ask for under each of the 12 requirements, our guide on how to prepare for a PCI audit sets out the steps in order, and our article on common PCI audit failures lists the twelve findings to fix before fieldwork.
What's included
What does a PCI compliance audit include?
Take the full programme or just the pieces you need.
- 01
Scoping and data-flow mapping
Workshops to trace every card data flow, confirm your cardholder data environment (CDE) and document the scope your assessor will validate each year under Requirement 12.5.2.
- 02
Gap analysis
A requirement-by-requirement review against PCI DSS v4.0.1 with a prioritised remediation plan, owners and realistic timescales. See our guide to gap analysis.
- 03
Remediation support
Help with network design reviews, policy and procedure writing, targeted risk analyses, and options analysis when you are choosing between technical solutions.
- 04
Report on Compliance (ROC)
Formal on-site and remote assessment by our QSAs, culminating in a ROC and Attestation of Compliance (AOC) for your acquirer or customers.
- 05
SAQ support and validation
We identify the right SAQ, check your answers and evidence, and can sign off the SAQ as your QSA where your acquirer requires it.
- 06
Testing and scanning
Internal and external PCI DSS penetration testing (Req. 11.4), segmentation testing, quarterly internal vulnerability scans (Req. 11.3.1) and quarterly external ASV scans (Req. 11.3.2) through our PCI SSC Approved Scanning Vendor partner. The physical access controls in Requirement 9 can also be tried in practice: our guide to physical penetration testing explains when that is worth doing.
- 07
Training and awareness
Introductory PCI awareness sessions, incident response training and secure software development (SDLC) training for your teams.
- 08
Programme management
A dedicated lead who plans the year, tracks evidence and keeps compliance running between assessments, not just in the month before.
- 09
Service provider assessments
A ROC or SAQ D for Service Providers, the AOC for Service Providers your customers ask for, and the extra service provider requirements such as segmentation testing every six months (Req. 11.4.6).
What we test for
PCI assessment types: self-assessment (SAQ), QSA-validated SAQ or ROC
Every assessment ends in a self-assessed SAQ, a QSA-validated SAQ or a ROC, summarised in a signed Attestation of Compliance. The PCI SSC issues no certificate; our guide to PCI DSS certification explains what the AOC proves. Here is how each route works, the evidence we test and what happens on audit day. To gather that evidence before fieldwork, work through our free PCI DSS audit evidence checklist, requirement by requirement.
Report on Compliance (ROC)
A full assessment in which our QSA tests every applicable PCI DSS v4.0.1 requirement and records the findings in the PCI SSC ROC template.
- Level 1 merchants: over 6 million transactions a year
- Level 1 service providers: over 300,000 a year
- Anyone whose acquirer or customers ask for one
- Interviews, document review, sampling and observation
- Defined or customised approach per requirement
- Summarised in an AOC for your acquirer
SAQ validated by a QSA
You complete the Self-Assessment Questionnaire that matches your payment channels. Our QSA checks your answers and evidence and, where your acquirer requires it, signs off the SAQ as your assessor.
- Level 2 to 4 merchants
- Level 2 service providers (SAQ D for Service Providers)
- SAQ A, A-EP, B, B-IP, C, C-VT, P2PE or D
- Evidence reviewed before anything is signed
- Useful when an acquirer asks for QSA involvement
Attestation of Compliance (AOC)
The signed declaration that summarises your ROC or SAQ result. It is the document acquirers, card brands and customers accept as proof of PCI DSS compliance.
- Signed by an officer of your company
- Also signed by the QSA where a QSA assessed or validated it
- Separate templates for merchants and service providers
- Sent to your acquirer with ASV scan reports where required
- Covers 12 months: you validate again every year
Evidence your QSA will ask for
Assessments run faster when evidence is ready before fieldwork. We send a tailored evidence request list early; the core items rarely change, and our free PCI DSS compliance checklist lists them under each of the 12 requirements.
- Network and cardholder data-flow diagrams
- System component inventory
- Policies, procedures and targeted risk analyses
- Configuration standards and system settings
- User access lists and MFA configuration
- Log review and alerting records
- Quarterly internal and ASV scan reports
- Penetration and segmentation test reports
- Security awareness training records
- Third-party provider list and their AOCs
- Incident response plan and test results
What happens on audit day
How long fieldwork takes depends on your scope, and we agree the dates in your quote. Each day follows an agreed plan, on site or remotely where the testing procedure allows.
- Opening meeting to confirm scope and the plan
- Interviews with system and process owners
- Configuration checks by screen share or on site
- Sampling of systems, locations, people and records
- Observation of processes such as media handling
- Daily wrap-up of open items and evidence gaps
Who completes and signs each type of PCI assessment?
The route decides who does the work and who puts their name to the result. Your acquirer confirms which route applies to you, based on your level and payment channels.
| Route | Who completes it | Who signs the AOC | Who needs it |
|---|---|---|---|
| Self-assessment (SAQ) | You, using the SAQ that matches your payment channels (A, A-EP, B, B-IP, C, C-VT, P2PE or D) | An officer of your company | Most Level 2 to 4 merchants, and Level 2 service providers (SAQ D for Service Providers), where the acquirer accepts self-assessment |
| QSA-validated SAQ | You complete the SAQ, then a QSA checks your answers and evidence | An officer of your company and the QSA | Merchants and service providers whose acquirer, card brand or customers ask for QSA involvement |
| Report on Compliance (ROC) | A QSA tests every applicable requirement and writes the ROC (some card brand rules let a Level 1 merchant use its own Internal Security Assessor) | An officer of your company and the QSA (or the ISA, where one carried out the assessment) | PCI Level 1 merchants (over 6 million transactions a year), Level 1 service providers (over 300,000 a year) and anyone whose acquirer or customers ask for one |
How the three documents fit together, and what goes in each, is covered in our guide to ROC vs AOC vs SAQ. For the policies, procedures and records a QSA samples under each requirement, use our PCI DSS document index.
Not sure which route applies to you? Our free PCI compliance check suggests your likely SAQ and flags critical gaps without leaving your browser, or use the enquiry form to ask us to scope and quote your PCI compliance audit.
How long does a PCI audit take?
A first Report on Compliance usually takes several months from the discovery call to a signed AOC, mostly because gaps have to be fixed and controls shown working before fieldwork starts. A renewal of a well-run programme, or a QSA-validated SAQ, is much quicker. This is what each stage involves and what you provide:
| Stage | Typical length | What you provide |
|---|---|---|
| Discovery call | A single call | How you take card payments, your merchant or service provider level, your acquirer’s requirements and your deadline |
| Scope and gap analysis | Set by the number of payment channels, sites and systems; the dates go in your quote | Network and cardholder data-flow diagrams, a system inventory, your third-party providers and people for the scoping workshops |
| Remediation | Usually the longest stage before a first ROC, often several months; little or none on a well-run renewal | An owner for each gap, then evidence that each fix is in place and has operated over time |
| Assessment (fieldwork) | Agreed at scoping and set by your scope, on site or remote where the testing procedure allows | The evidence library, interviewees, screen-share or on-site access for configuration checks, and the samples the QSA selects |
| ROC and AOC | Once fieldwork closes and open items are resolved | Answers to any open items, then an officer’s signature on the Attestation of Compliance |
| Business as usual | The 12 months until your next annual assessment | Quarterly internal and ASV scan reports, penetration and segmentation test results, and the reviews PCI DSS sets at fixed intervals |
Starting from scratch? Our guide on how long it takes to prepare for a PCI audit sets out a month-by-month plan for a first ROC.
How it works
PCI DSS audit timeline: from discovery call to AOC
- 1
Discovery call
We learn how you take payments, your merchant or service provider level and your deadline, then send a fixed quote.
- 2
Scope and gap analysis
Data-flow workshops, system inventory and a gap report showing exactly what is missing.
- 3
Remediation
You close the gaps with our guidance. We review evidence as you go so nothing is left to the final audit. For a first ROC, this is usually the longest stage.
- 4
Assessment
Our QSA tests every in-scope requirement through interviews, documentation review, sampling and technical observation, to the timetable agreed at scoping.
- 5
ROC and AOC
We issue the Report on Compliance and Attestation of Compliance, ready to submit to your acquirer or share with customers.
- 6
Business-as-usual
Quarterly check-ins, scans and testing so next year’s assessment is a formality.
Why Sovereign Secure
Why choose Sovereign Secure for your PCI audit?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- A genuine QSA company. Approved by the PCI Security Standards Council to assess and sign off PCI DSS compliance. Verify us on the PCI SSC QSA list before you sign anything.
- Payments specialists. We also assess PCI PIN and Card Production, so we understand the whole payments chain, not just the web shop.
- Scope first. Reducing scope is the fastest way to cut the cost of compliance, and we look for it before we test anything.
- Global reach. A UK headquarters in Accrington plus offices in Los Angeles, Singapore, Dubai and Dhaka for multi-site and multi-country estates.
- GEAR member 2026 to 2028. Sovereign Secure sits on the PCI SSC Global Executive Assessor Roundtable, the forum where senior leaders of qualified assessor companies give the Council recommendations and input.
- Fixed quotes. After a short scoping call you get a fixed price, so you know the full cost before work starts.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Who carries out a PCI compliance audit?
Usually a Qualified Security Assessor (QSA) company approved by the PCI SSC, although many smaller merchants self-assess with an SAQ and some card brand rules let a Level 1 merchant use a trained Internal Security Assessor (ISA). Our PCI QSA page explains when you need a QSA and how a QSA differs from an ISA.
What do we receive at the end of the audit?
A Report on Compliance or validated SAQ, plus a signed Attestation of Compliance (AOC) as your proof of compliance; the PCI SSC issues no certificate, as our guide to PCI DSS certification explains.
How long does a PCI DSS assessment take?
It depends on your scope and how ready you are. Validating an SAQ is usually much quicker than a ROC, and a first ROC takes longest because scoping, gap analysis and remediation come before the formal assessment. Renewals are quicker once scope is stable, and we give you a timetable with your quote.
How often are PCI audits required?
Every year. PCI DSS compliance is validated annually, so an AOC is normally accepted for 12 months from the date it is signed. Plan your next assessment before it lapses, and keep quarterly scans, testing and reviews running in between so the renewal is straightforward.
What are the PCI audit requirements?
A confirmed scope with network and data-flow diagrams, current policies and procedures, and scan and penetration test reports ready to sample; our guide on PCI audit requirements and preparation sets out what the auditor needs.
Who requires us to validate PCI DSS compliance?
Your acquirer, under your merchant agreement and on behalf of the card brands, or your customers’ contracts if you are a service provider. It is a contractual requirement rather than a law, as our guide to PCI compliance in the UK explains.
How much does a PCI DSS audit cost?
Cost depends almost entirely on scope: the number of locations, systems, payment channels and third parties involved. After a short scoping call we give you a fixed quote, so you know the full cost before work starts. Our guide to PCI compliance cost explains the main cost drivers.
Which version of PCI DSS will we be assessed against?
PCI DSS v4.0.1, the only active version since v4.0 was retired at the end of 2024. v4.0 introduced the customised approach, targeted risk analyses, stronger authentication requirements (MFA for all access into the CDE), payment page script controls for e-commerce and an annual scope confirmation. v4.0.1 is a limited revision that clarified wording. The v4.0 future-dated requirements became mandatory on 31 March 2025. See our PCI DSS 4.0.1 changes guide.
Can the assessment be done remotely?
Much of the work, such as document review, interviews and configuration evidence, can be done remotely. Some testing procedures still call for observation on-site. We agree the right mix with you and, where needed, your acquirer.
We use a payment service provider. Are we still in scope?
Usually yes, but much less of your environment may be in scope. Outsourcing card handling to a compliant provider can move you to a much simpler SAQ. You remain responsible for managing that provider and for the parts of the payment flow you control, such as the page that redirects to or embeds the payment form.
Can you help us prepare as well as assess us?
Yes. Our PCI DSS consultancy covers scoping, gap analysis and remediation before the formal audit. Where we provide consultancy, we keep advisory and assessment work appropriately separated, as the PCI SSC expects of a QSA company.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- PCI QSAPCI QSA services from a PCI SSC-approved PCI DSS QSA company: ROCs, AOCs and QSA-validated SAQs, plus PCI PIN and card production. Get a fixed quote.
- Service provider complianceAre you a PCI compliance service provider? A QSA company explains who counts, Visa and Mastercard levels, extra v4.0.1 requirements, ROC and AOC. Get a quote.
- PCI DSS ConsultancyPCI DSS consultancy and consulting services from a PCI SSC-approved QSA company: scoping, gap assessment, remediation, policies and SAQ help. Get a fixed quote.
- PCI DSS penetration testingPCI compliance penetration testing to PCI DSS Requirement 11.4 by a QSA company: internal, external, application and segmentation pen tests with ROC-ready reports.
- PCI ASV scansPCI scanning made simple: quarterly PCI ASV scans run through our PCI SSC Approved Scanning Vendor partner and managed by a QSA company. Get a fixed quote.
- PCI compliance costWhat PCI DSS compliance costs in the UK: QSA audit, SAQ, ASV scan and pen test cost drivers, plus a free estimator.
- PCI compliance levelsPCI compliance levels explained by a QSA company: Visa merchant levels 1 to 3 and Mastercard levels 1 to 4, service provider levels and what each submits.
- PCI PIN security auditsPCI PIN security assessments and audits by a PCI SSC Qualified PIN Assessor for acquirers, processors, key injection facilities, ATM and POS networks.
- PCI Card Production auditsPCI Card Production and Provisioning assessments by a PCI SSC-approved CPSA: logical and physical security audits for card manufacturers and personalisers.
- Network & infrastructure testingNetwork penetration testing for UK firms: external perimeter, internal network and Active Directory attack paths, plus PCI DSS segmentation tests. Get a quote.
Further reading
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“We would happily recommend them to any company in need of the services mentioned.”
Call +44 161 523 5276
Email [email protected]