How to Choose a SOC 2 Auditor: What to Check and What to Ask

Choose a SOC 2 auditor by checking three things before price: the firm is a licensed CPA firm, its latest AICPA peer review passed, and it regularly audits companies of your size on the scope you need. Then compare quotes on identical terms and ask who will actually do the work.

Only a licensed CPA firm can perform a SOC 2 audit and sign the report (Linford & Co). Readiness consultants and software can help you prepare, but the opinion your buyers read must come from a CPA firm, and that firm's name is on every copy of the report you send.

Our recommended path is a security-only SOC 2 Type 2 with a 3-month observation window. Ask every firm to quote exactly that, so the numbers are comparable. A Type 1 is the option when a prospect needs a report in under about 3 months.

The sections below cover who can audit you, how to check a firm's peer review, the questions to ask, how to compare quotes, and the firm we work with.

SOC 2 is an attestation engagement performed under AICPA standards, so the auditor must be a licensed CPA firm (Johanson Group). The firm must also be independent of you. A firm that designed or runs your controls cannot audit them, which is why your auditor will not write your policies for you.

Firms come in three broad sizes. Large national firms bring brand recognition and handle complex programs across many frameworks, at prices and timelines built for large companies. Mid-size firms cover a wide range of clients. Boutique firms that focus on SOC audits often work mostly with startups and small software companies, know cloud-native environments well, and move quickly.

For a first report at a small company, a peer-reviewed boutique or mid-size firm with a strong startup practice is usually the right fit. A firm used to auditing banks may not understand a team of ten that deploys several times a day, and you will spend time explaining it. Ask for references from companies like yours, such as other seed-stage startups on the same cloud provider.

Once every three years, audit firms must go through the AICPA peer review process, and SOC 2 engagements are among the work a reviewer must select (Linford & Co). The result tells you whether another firm found the auditor's work meets professional standards.

You can check a firm yourself. The AICPA's public file search lists public accounting firms and their enrollment status in the peer review program (AICPA). Search by firm name, and look for the review period, the date the review was accepted, and its rating. Some firms' review documents are viewable only if the firm chose to make them public, so if you cannot see the rating, ask the firm for its latest peer review letter.

Your buyer's security team can run the same search on the firm that signed your report. A report from a firm with a failed or missing peer review invites questions you do not want in the middle of a deal.

Ask every firm the same questions, in writing, so you can compare the answers.

• How many SOC 2 reports did you issue last year for companies of our size and type?
• Who will do the fieldwork, and how involved will the partner be?
• What evidence formats do you accept, and can you work from the tools we already use?
• How long from the end of fieldwork to the final report, and what usually slows it down?
• What do you expect for penetration testing and vulnerability scanning?
• Is the fee fixed, and what triggers extra charges?
• What will the second and third years cost?

Experience with companies your size and the partner's involvement are the two questions CPA firms themselves suggest asking first (Linford & Co), and budgeting over two or three years is a common recommendation too (Johanson Group).

Listen to how they answer as much as to what they say. A good auditor explains requirements in plain language and tells you early when something will not pass. That matters more over a relationship of several years than a small difference in price. If a firm cannot say who will do your fieldwork, or will not put the fee in writing, keep looking.

Audit quotes vary widely, and most of the variation is scope, not quality. Before you compare prices, make sure every firm quoted the same thing:

• The same report and window: a Type 2 with a 3-month observation window on the recommended path.
• The same criteria: Security only, unless a customer requires more.
• The same system boundary: the product, and the infrastructure, people, and vendors behind it.
• The same deliverables: the report itself, any letters you will need between reports, and the number of review rounds on the system description.

Once the terms match, compare the total cost over the first two or three years, including renewals, rather than the first invoice. A firm that discounts the first year and raises the second can cost more in the end.

Price is not the only line to compare. Ask how many hours of your team's time the audit usually takes, and how evidence is collected. An auditor who can work from well-organized evidence in one place finishes faster. For every cost around the audit, see the SOC 2 cost guide.

If you want a starting point, MJD Advisors is a peer-reviewed, US-based CPA firm. With MJD, SOC 2 pricing is Type 1 from $5,000, Type 2 from $7,500 per year. MJD Advisors is SimpleAudit's audit partner.

Whichever firm you choose, run the same checks: the peer review, the references, and a quote on the same terms as everyone else. A good auditor is one you will work with for years, so the fit matters as much as the first price.

When you are ready to book, the SOC 2 checklist shows where the auditor fits into a readiness plan, and why you should book the auditor in the first week.