Choosing an auditor

Who may issue a report, how firms differ, and what to ask before signing.

Who can issue a SOC 2 report?

A licensed CPA firm, and nobody else. That constraint surprises people. Compliance software does not issue reports. Neither does a consultancy without the licence. Firms differ enormously in rigour, and your report carries the name of whoever signed it. A reviewer at a large customer may know the firms by reputation. Ask how a prospective auditor samples. Ask what they do when they find an exception. Ask how much of your work stays yours. Those answers separate firms faster than price does.

3 sources

Related: Is SOC 2 a certification?, What drives the cost of getting audited?

How do I choose an auditor?

Check the licence, the peer review, and how they plan to sample. Anyone issuing your report must be a licensed CPA firm, and SOC engagements fall under peer review. AICPA peer reviewers have been told to look for firms producing identical reports, risk assessments, sample sizes and testing procedures. In peer review that is a nonconforming engagement. So ask how their testing differs for your system. A firm that cannot answer specifically is describing a template. Your customer's reviewer will recognise one.

3 sources

Related: Who can issue a SOC 2 report?, What is peer review and why should I care?

What is peer review and why should I care?

It is how the profession checks the firm checking you. CPA firms performing SOC engagements are subject to peer review, and the AICPA has sharpened what reviewers look for as volumes rise. This matters to you commercially, not professionally. A report from a firm whose work misses the standards is a report your customer may reject. A rejected report leaves you the cost and none of the benefit. So ask a prospective auditor about their peer review history. It is a reasonable question and a normal one.

3 sources

Related: How do I choose an auditor?, Who can issue a SOC 2 report?

What are the standards my auditor has to follow?

The AICPA's Statements on Standards for Attestation Engagements. Your auditor is not free to design the engagement however you both prefer. That is worth knowing when a timeline sounds too good. SOC examinations run under those standards, and the AICPA promulgates them. A firm not following them can be reported to a state board of accountancy. That mechanism sits behind the profession's concern about quick-turn engagements. You are not expected to police your auditor. You are entitled to ask which standards apply.

2 sources
  • Promises of 'fast and easy' threaten SOC credibility — Journal of Accountancy

    "SOC reports are examinations performed by CPAs in accordance with the AICPA's Statements on Standards for Attestation Engagements." "The real risk is if a firm is not following the standards in their performance or reporting, they should be reported to the state board of accountancy."

    Read 2026-09-05

  • System and Organization Controls: SOC Suite of Services — AICPA & CIMA

    "The AICPA promulgates the professional standards for SOC engagements."

    Read 2026-09-05

Related: Who can issue a SOC 2 report?, How do I choose an auditor?