Choose a SOC 2 auditor by checking four things in order. First, that it is a licensed CPA firm, because only a CPA firm can issue a report under the AICPA's SOC 2 name, and that its most recent AICPA peer review was clean. Second, that it is independent of your controls: a firm that designed or runs them cannot examine them. Third, that it has examined companies like yours, on your kind of infrastructure, recently. Fourth, how it runs fieldwork: who does the work, how evidence is requested and sampled, and how long the report takes after the period ends. Price matters, but it only compares well between firms that pass the first three.
Your SOC 2 report carries your auditor's name, and an experienced reader notices it. Choosing the firm is a decision about credibility with your buyers as much as about price and scheduling, and it is easier to get right before the engagement letter than after.
1. Licensing and peer review
A SOC 2 examination is an attestation engagement under AICPA standards, so the report has to come from a licensed CPA firm. Firms that perform these engagements take part in the AICPA's peer review program, in which another firm reviews their quality control. Ask for the firm's most recent peer review report and its rating. A firm that cannot tell you, or whose name appears nowhere on the report, is a reason to stop.
2. Independence
The auditor cannot examine controls it designed, implemented or operates. That rules out a firm that ran your readiness project in a way that made management decisions for you, and it rules out bundles in which the same team builds your controls and then tests them. Readiness support from a separate advisor is common and fine; ask the audit firm how it keeps the two apart.
3. Relevant experience
- How many SOC 2 examinations has the firm completed in the last year, and for companies of your size?
- Has it examined companies on your infrastructure, such as your cloud provider, identity provider and deployment pipeline?
- Can it accept evidence exported from your systems and tools, or does it expect screenshots?
- Who on the team has done this work before, and will they be on your engagement?
4. How fieldwork runs
- How evidence is requested: a list up front, a shared portal, or ad hoc requests during fieldwork.
- How populations and samples are selected, and when samples are requested during the period.
- Who does the testing, where they are based and how much of the work is reviewed by senior staff.
- How long after the review period ends the report is usually issued, and what slows it down.
- How exceptions are discussed with you before the report is drafted.
If your buyers are in Europe
European buyers often ask for ISO 27001, an ISAE 3000 report, or a SOC 2, and sometimes for more than one. Ask whether the firm can issue an ISAE 3000 report from the same examination work. If you also need ISO 27001, ask whether it works with an accredited certification body for that standard. The comparison of SOC 1, SOC 2 and SOC 3 covers where the ISAE standards fit.
Comparing quotes
| Ask about | Why it matters |
|---|---|
| What the fee covers | Type 1, Type 2, a SOC 3, and any readiness assessment, priced separately or together |
| Scope assumptions | The number of systems, locations and criteria categories the quote is based on |
| What changes the fee | Scope changes, additional categories, late evidence or extra rounds of review |
| Multi-year terms | Whether the next periods are priced, and on what assumptions |
| Timeline commitments | When fieldwork happens and when the report is expected after the period ends |
The SOC 2 audit timeline covers how fieldwork and issuance fit into the overall schedule.