How to Choose a SOC 2 Auditor: A Buyer's Guide

Why the choice matters

Most companies come to SOC 2 the same way. A customer or prospect asks for a SOC 2 report, someone on the team is handed the job of “getting one,” and there is a short list of firms whose websites all say roughly the same thing.

It is easy to treat the decision as a commodity purchase. Every SOC 2 report follows the same AICPA standards, uses the same Trust Services Criteria, and ends with an opinion from a CPA firm. But the firm you choose shapes how the year goes: how much of your team’s time the audit takes, whether your customers’ security reviewers accept the report without a round of follow-up questions, and whether you start over with a new team next year.

This guide covers what to check, what to ask, and what to be cautious about. It applies to any firm you are considering.

Remember who the report is for

A SOC 2 report is not really written for the company being audited. It is written for that company’s customers, their auditors, and their vendor risk teams. They are the ones who read it, rely on it, and decide whether it answers their questions.

That changes how to evaluate a firm. The question is not only “Can this firm get us a report?” It is “Will the people reading this report trust it?” A report with a thin system description and testing that reads like a checklist can create more questions than it answers. It is common for a company to send customers a brand-new SOC 2 and still receive a long security questionnaire, because the report did not give the reader enough to rely on.

Know what your customers need before you call anyone

Every firm you talk to will give better answers if you can answer a few questions first. If you can’t answer them yet, a good auditor will walk through them with you on the first call. Knowing them still helps you compare firms on the same footing.

Type I or Type II? A Type I report covers the design of your controls as of a specific date. A Type II report also covers whether those controls operated effectively over a period of time, usually 6 to 12 months. Many customers accept a Type I for a first report and expect a Type II after that. Ask your customer which they need rather than guessing.

Which Trust Services Criteria? Security (also called the common criteria) is required in every SOC 2. Availability, Confidentiality, Processing Integrity, and Privacy are optional. Add them because they fit your services or because your customers ask for them, not because more criteria sound more impressive. Each one adds work.

Which services and systems are in scope? Usually this is the product or service your customers are asking about. It does not have to be every system your company uses.

When do you need the report in hand? This date drives almost everything else, including whether a Type I makes sense first and when a Type II period can start. Give every firm the same date and compare how each one responds to it.

If any of this is unclear, ask your customer for their vendor requirements or the contract clause that mentions SOC 2. It is often more specific than expected.

Check the basics. They are easy to verify.

These are not differentiators. They are the minimum, and each one can be checked in a few minutes.

The firm must be a licensed CPA firm. SOC 2 examinations are attestation engagements under the AICPA’s standards (SSAE No. 18), and only a licensed CPA firm can issue the opinion. Some companies market “SOC 2 audits” and then hand the actual opinion to a separate CPA firm you never meet. Ask who will sign the report. A firm’s license can be looked up with its state board of accountancy or through CPA Verify, the national lookup maintained by NASBA.

The firm should have a current peer review. CPA firms that perform attestation work go through peer review, an outside review of their quality control, on a regular cycle. Results for firms enrolled in the AICPA program are in the AICPA’s public peer review file. Look the firm up. If it isn’t there, ask why.

The firm must be independent of you. Independence is the whole reason a SOC 2 report means anything. Under the AICPA’s rules, an auditor cannot design or implement your controls, write your policies for you, or make management decisions for you, and then give an opinion on them. The independence section below covers where this gets confusing.

Find out who will actually do the work

This part of the decision most affects the day-to-day experience, and it is often the part buyers ask about last.

The sales call may be with an experienced partner or a polished salesperson. Then the engagement starts, and the work is done by someone who joined the firm last month. Ask directly:

Who will scope our audit and set the fee?
Who will lead the fieldwork, and who will be on the team?
How involved will a partner be during the audit, not just at the beginning and end?
Where is the team located? Will any of the work be done offshore?
If we renew next year, will we have the same people?

The last question matters more than it seems. The first year of a SOC 2 involves a lot of learning on both sides. The auditor has to understand your services, your systems, and how your team works. When the same team returns the next year, they already know what to ask for and what evidence looks like in your environment. When the team turns over every year, your people explain the same things again, and the audit takes more of their time.

Understand independence, especially with a compliance platform

Many companies now prepare for SOC 2 with compliance automation software. These tools can be useful for collecting evidence and keeping policies organized. The question for a buyer is how the platform and the audit firm are connected.

Some platforms bundle an audit into their subscription or steer customers toward a short list of “partner” audit firms. That is not automatically a problem, but it is worth asking the audit firm a few plain questions:

Do you pay or receive referral fees from any software vendor or platform?
Does the platform pay you, or do we pay you directly?
If we change platforms next year, does anything about our audit change?
Will you test our controls in the environment we actually run, or mainly review what the platform has collected?

The reason to ask: an auditor’s job is to form an independent opinion for your customers. If a firm depends on a platform for a steady stream of clients, it is fair to ask whether that firm can comfortably deliver a report with exceptions, or a qualified opinion, when the evidence calls for it. Your customers’ reviewers increasingly ask the same question. Recent public reporting about large numbers of near-identical SOC 2 and ISO reports tied to a single compliance vendor has made vendor risk teams more careful.

Two other independence points come up often:

Readiness assessments are fine. Doing the work for you is not. A SOC 2 readiness assessment is a dry run of the examination before the first audit. The auditor walks through your environment and issues a management letter listing any gaps. That is a normal and useful step. What the auditor cannot do is design your controls, write your policies, or run your compliance program for you and then audit the result. Be careful with any firm that offers to “take care of everything.” Your team owns its controls.

A report with an exception is not a failed audit. Exceptions happen, and a report that shows them honestly is often more credible to a reader than one that looks too clean. Be wary of any firm that guarantees an unqualified opinion before it has tested anything.

Look at how the firm scopes and quotes

How a firm arrives at a fee says a lot about it.

A firm that quotes a price within minutes, before asking how your services work, what systems support them, or which subservice organizations you rely on, is pricing a template. That works if your environment happens to match the template. If it doesn’t, the difference tends to show up later as change orders, extra fees, or testing that is thinner than your customers expect.

A good firm should be able to tell you, in writing and before work begins:

What is in scope: the services, systems, Trust Services Criteria, and report type
What the fee is and what could change it
What the timeline is, working back from the date you need the report
What they will need from your team, and roughly when

The main drivers of a SOC 2 fee are fairly consistent from firm to firm: Type I versus Type II, the number of criteria in scope, the size and complexity of your systems and locations, how many subservice organizations you rely on (such as cloud hosting providers), how mature and documented your controls are, and whether SOC 2 is combined with another framework like HIPAA or ISO 27001. If two quotes are far apart, compare them against that list. Usually one firm is assuming a smaller scope than the other.

Ask what the process looks like from your side

The audit will take some of your team’s time no matter which firm you choose. The difference is how organized that time is. Ask each firm to walk through the engagement from your team’s point of view:

Will we get one organized request list up front, or requests one at a time?
Will you give us a risk and controls matrix so we can see what will be tested?
How are interviews and walkthroughs scheduled? Remote, onsite, or both?
How often will we get status updates?
If you find a potential exception, when will we hear about it?
Will we review a draft of the report, including the system description, before it is final?

The exception question is a good test. A firm should raise a potential exception when it finds it, not save it for the end. That gives your team a chance to understand it and provide anything that was missed.

Ask what the report will look like

A firm should not show you another client’s report. You can still ask how its reports are put together and who reads them.

A SOC 2 report includes the auditor’s opinion, management’s assertion, a description of your system, and, for a Type II, the controls tested and the results. The system description is where many reports fall short. It should describe your actual services, infrastructure, people, processes, and data in enough detail that a reviewer understands what they are relying on. A generic description that could belong to any company suggests the work behind it may be generic too.

Also ask how the firm handles subservice organizations, such as your cloud hosting provider, and whether the report will clearly identify the complementary controls your customers are expected to have in place. Reviewers look for both.

Red flags

None of these alone means a firm is a bad choice, but each one deserves a direct question:

The firm guarantees a “clean” report, or promises to “pass” you before testing anything.
The firm offers to write your policies or controls and then audit them.
The firm quotes a fee before asking about your services or systems.
The firm you sign with is not the CPA firm that issues the opinion.
The firm’s license or peer review can’t be found, and no one can explain why.
No one can say who will be on your audit team.
The audit is “included” with software, and no one can explain who the auditor answers to.
The proposed timeline is far shorter than every other firm’s, with no explanation of what is different.

Questions to ask every firm you interview

Bring the same list to every call so the answers can be compared side by side.

Are you a licensed CPA firm, and will your firm sign the SOC 2 opinion?
When was your last peer review, and where can we see the results?
Who will scope, lead, and work on our audit? How involved will a partner be?
Is any of the work performed offshore?
Will we have the same team next year?
Do you pay or receive referral fees from any software vendor or compliance platform?
How do you arrive at the fee, and what could change it after we sign?
What will you need from our team, and when?
How will you tell us about potential exceptions during the audit?
Will we review a draft report before it is final?
Who will answer our customers’ questions about the report after it is issued?
Have you audited companies with services and systems similar to ours?

Cost and value

Price matters, and it should. But the cost of a SOC 2 is not only the auditor’s fee. It also includes your team’s time during the audit, the follow-up questions customers send when the report doesn’t answer them, and the time it takes to re-explain your environment to a new team each year. Those hidden costs are a common reason companies switch auditors.

The simplest test: choose the firm whose people you would want to see again next year, and whose report your customers will read without sending a second questionnaire.