# Choosing an auditor

Who may issue a report, how firms differ, and what to ask before signing.

Source: https://intransic.com/questions/auditor-selection

## Who can issue a SOC 2 report?

A licensed CPA firm, and nobody else. That constraint surprises people. Compliance software does not issue reports. Neither does a consultancy without the licence. Firms differ enormously in rigour, and your report carries the name of whoever signed it. A reviewer at a large customer may know the firms by reputation. Ask how a prospective auditor samples. Ask what they do when they find an exception. Ask how much of your work stays yours. Those answers separate firms faster than price does.

Sources:
- [System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) — AICPA & CIMA, read 2026-09-05
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05
- [Common peer review deficiencies from SOC 1 and SOC 2 engagements](https://www.aicpa-cima.com/resources/download/see-common-peer-review-deficiencies-from-soc-1-r-and-soc-2-r-engagements) — AICPA & CIMA, read 2026-09-05

## How do I choose an auditor?

Check the licence, the peer review, and how they plan to sample. Anyone issuing your report must be a licensed CPA firm, and SOC engagements fall under peer review. AICPA peer reviewers have been told to look for firms producing identical reports, risk assessments, sample sizes and testing procedures. In peer review that is a nonconforming engagement. So ask how their testing differs for your system. A firm that cannot answer specifically is describing a template. Your customer's reviewer will recognise one.

Sources:
- [AICPA guides peer reviewers to address SOC 2 risks](https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/) — Journal of Accountancy, read 2026-09-05
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05
- [Common peer review deficiencies from SOC 1 and SOC 2 engagements](https://www.aicpa-cima.com/resources/download/see-common-peer-review-deficiencies-from-soc-1-r-and-soc-2-r-engagements) — AICPA & CIMA, read 2026-09-05

## What is peer review and why should I care?

It is how the profession checks the firm checking you. CPA firms performing SOC engagements are subject to peer review, and the AICPA has sharpened what reviewers look for as volumes rise. This matters to you commercially, not professionally. A report from a firm whose work misses the standards is a report your customer may reject. A rejected report leaves you the cost and none of the benefit. So ask a prospective auditor about their peer review history. It is a reasonable question and a normal one.

Sources:
- [AICPA guides peer reviewers to address SOC 2 risks](https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/) — Journal of Accountancy, read 2026-09-05
- [Common peer review deficiencies from SOC 1 and SOC 2 engagements](https://www.aicpa-cima.com/resources/download/see-common-peer-review-deficiencies-from-soc-1-r-and-soc-2-r-engagements) — AICPA & CIMA, read 2026-09-05
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05

## What are the standards my auditor has to follow?

The AICPA's Statements on Standards for Attestation Engagements. Your auditor is not free to design the engagement however you both prefer. That is worth knowing when a timeline sounds too good. SOC examinations run under those standards, and the AICPA promulgates them. A firm not following them can be reported to a state board of accountancy. That mechanism sits behind the profession's concern about quick-turn engagements. You are not expected to police your auditor. You are entitled to ask which standards apply.

Sources:
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05
- [System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) — AICPA & CIMA, read 2026-09-05