Hot take: most SOC 2 pain is process, not tooling. Fix the process and the audit gets boring (in a good way). What's been your experience?