SOC 2 compliance › Choose an auditor
SOC 2 auditorHow to choose a SOC 2 auditor: what to verify, score and ask
Most guides list qualities to look for. This one gives a verify-then-score method: four gates every auditor must pass, five criteria to compare, and the questions that expose the difference.
Free for buyers · provider-funded introductions · Updated October 2026
How do you choose a SOC 2 auditor?
Choose a licensed CPA firm that will sign the report, shows good standing in AICPA peer review, is independent of how your controls were built, and issues a report your customers accept. Once a firm passes those four gates, compare it with others on experience like yours, scope fit, timeline and people, fees and terms, and its evidence process.
- Only a CPA firm can issue a SOC 2 opinion. Advisors and platforms help you prepare.
- Check the licence and the peer review record yourself. It takes a few searches, not a vendor’s word.
- Ask your customers which report they need before you ask any auditor for a quote.
Do not rank firms by logo. A report your customer will not accept is the costliest outcome, whatever the fee.
Auditor, advisor or platform: who can sign a SOC 2 report?
Three roles get blurred in vendor content. Only one issues the opinion.
| Role | What it does | Can it issue the SOC 2 opinion? | Typical use |
|---|---|---|---|
| CPA firm (auditor) | Examines your controls against the Trust Services Criteria and issues the report | Yes | Always needed for a SOC 2 report |
| Advisor or consultant | Gap review, policies, control design and evidence support | No | Before the audit window |
| Compliance platform | Evidence collection and monitoring software. Some partner with or bundle an auditor | No | Throughout, if you choose automation |
Some CPA firms also offer readiness work, and some platforms resell an audit. Both raise the independence question in check 3 below. For readiness, see the readiness checklist.
The 8 checks: what to verify before you sign
Checks 1 to 4 are gates. Checks 5 to 8 are for comparing firms that pass.
| Check | Why it matters | How to verify | Red flag |
|---|---|---|---|
| 1. Licensed CPA firm that signs | Only a licensed CPA firm can issue a SOC 2 report. | Search the firm on CPAverify, a free database fed by state boards of accountancy. If it is missing, check the state board directly. | No CPA firm is named, or an advisor or platform signs. |
| 2. Peer review standing | Peer review is how a firm’s own attest work is reviewed. SOC engagements fall under system reviews. | Search the AICPA peer review public file for enrolment. Ask the firm for its latest peer review report, because documents are posted only for some firms. | The firm cannot be found or will not discuss it. |
| 3. Independence | A firm that designs your controls and then tests them faces a self-review threat. | Ask who built your controls. If the firm also did readiness work, ask which safeguards apply and who on your side oversees it. | The same people write your controls and audit them. |
| 4. Customer acceptance | The report exists for your customers. If they reject it, the audit missed its purpose. | Ask the buyers or procurement teams who need it which report type and firms they accept. | You pick a firm before asking the customer. |
| 5. Experience like yours | Auditors who know your stack and size need fewer explanations and spot gaps sooner. | Ask for recent engagements of similar size, cloud setup and criteria, with references or anonymised summaries. | Generic claims and no comparable clients. |
| 6. Scope and criteria fit | The firm must be able to examine the criteria and boundary you need. | Give every firm the same scope: criteria, systems and Type 1 or Type 2. | A quote with no stated scope. |
| 7. Timeline and people | Delays come from slow requests and unclear ownership. | Ask for a stage-by-stage plan, a named lead and a sample request list. See the audit process and the timeline. | A guaranteed date before scope and report period are agreed. |
| 8. Fees and terms | Quotes differ more in what they include than in the headline fee. | Compare line by line: report type, exceptions and re-tests, year two and payment schedule. See what drives SOC 2 cost. | A single price with no scope, or pressure to sign fast. |
Checks 1 to 4 are gates: a firm must pass all four. Checks 5 to 8 compare firms that pass. Peer review cycles are described by one CPA firm as every three years, so ask for the date of the latest one.
Verify an auditor in four steps
Do this before you share anything beyond scope.
CPAverify holds licence data that state boards supply, so coverage depends on each board. If a firm does not appear, check the state board directory before drawing conclusions. Peer review documents are posted in the public file only for some firms, so ask the firm directly.
Gates first, then scores: how to shortlist SOC 2 auditors
Pass or fail comes before price. This keeps a cheap quote from hiding a weak firm.
Gates are pass or fail. Scores only matter between firms that pass every gate. Weight the five scores to your own priorities, and write the weights down before quotes arrive.
8 red flags when choosing a SOC 2 auditor
Any one is a reason to pause. Two or more is a reason to walk away.
No CPA firm is named
A SOC 2 opinion needs a licensed CPA firm. If the proposal names a platform or advisor as the issuer, stop and ask who signs.
Peer review cannot be found
Look the firm up in the AICPA public file and ask for its latest report. Silence or deflection is the warning.
Same team builds and audits
When one firm designs your controls and tests them, ask for the safeguards in writing and who on your side oversees the work.
Customer was never asked
If your buyers have not confirmed the report type and auditors they accept, you may pay for a report they decline.
Date promised before scope
A guaranteed delivery date before the report period and scope are set is a sales line, not a plan.
One price, no scope
A single number with no criteria, systems, report type or exception terms cannot be compared with another quote.
No comparable clients
Generic claims with no examples of similar size, stack or criteria suggest you would be the learning case.
Pressure to sign fast
Urgency before you have verified licence, peer review and scope usually protects the seller, not you.
Auditor vs advisor vs platform: what each does and what to ask
Use this table when a proposal bundles two roles.
| Factor | CPA firm auditor | Advisor or consultant | Compliance platform |
|---|---|---|---|
| Issues the SOC 2 opinion | Yes | No | No |
| Main job | Independent examination of controls | Prepare you and fix gaps | Collect evidence and monitor controls |
| When you need it | The audit window | Before the audit | Before and during |
| Independence concern | Arises if it also designed your controls | None for the audit, as it does not sign | None for the audit, as it does not sign |
| What to ask | Licence, peer review, experience | Which auditor it works with and whether it earns referral fees | Whether the auditor is separate and who you contract with |
15 questions to ask every SOC 2 auditor before you sign
Five groups of three. Send them in writing before any call.
Signing and standing
- Which licensed CPA firm signs the report, and in which state?
- When was your last peer review and can we see the report?
- Who on the team signs, and who reviews the work?
Independence
- Did you or an affiliate help build or advise on our controls?
- What safeguards apply if you did, and who oversees them on our side?
- Do you pay or receive referral fees for this engagement?
Fit
- Which recent engagements are like ours in size, stack and criteria?
- Have you examined the criteria we need, and the Type we need?
- Will customers in our market accept your report?
Delivery
- What is the stage-by-stage plan and who leads it?
- How do evidence requests work and how long to answer them?
- How are exceptions raised before they reach the report?
Commercial
- What exactly does the fee include: report type, re-tests, exceptions?
- What changes the price after signing?
- What will year two cost and what are the payment terms?
Send the same questions to every firm and compare written answers. Differences in how firms answer are often more useful than the answers.
SOC 2 auditor FAQ
Short answers to the questions buyers ask before they appoint a firm.
Who can perform a SOC 2 audit?
Can a compliance platform or consultant issue a SOC 2 report?
How do I check that an auditor is a licensed CPA firm?
What is peer review and why does it matter?
How often does a firm go through peer review?
Does my auditor need to be an AICPA member?
Can the same firm do my readiness work and my audit?
How much do SOC 2 auditors charge?
Do I need a Big 4 firm for SOC 2?
How many auditors should I get quotes from?
How long is a SOC 2 report valid?
What should I do before I contact an auditor?
Know who must sign. Then compare firms on the same scope.
Free for buyers · provider-funded introductions