How to choose a SOC 2 auditor
Your customers read the auditor's name on the report, and the firm you pick decides how credible it is. Start with four checks, then ask every firm the same questions on the same scope.
Four checks before you take a quote
| Check | What to look for |
|---|---|
| Is it a licensed CPA firm? | Only licensed CPA firms can perform SOC 1 and SOC 2 engagements. A non-CPA firm can't partner with one to issue the report under its own name. [source] |
| Is it enrolled in AICPA peer review, and when was its last accepted review? | Search the firm in the AICPA public file, which shows enrollment and the most recent accepted peer review. [source] |
| Is it independent of your software vendor? | Ask about commercial arrangements with your compliance platform, such as referral fees or bundled pricing. The AICPA has published Ethics Staff Insights on business arrangements with SOC tool providers. [source] |
| Who writes the report narrative? | Ask who drafts the description and conclusions, and check that the language is specific to your environment rather than boilerplate. Drata includes this in its audit-quality checklist. [source] |
12 questions to ask every firm
Adapted from Drata's help center list of questions for a potential SOC 2 auditor (source) and its post on audit integrity (source). Drata sells compliance software, but these questions apply whichever platform you use, or if you use none.
- Which Trust Services Criteria do you recommend for us, and why?
- What will you test beyond what our compliance platform's dashboard shows?
- What share of our controls can you verify through our platform's auditor access, and what will you test separately?
- Who writes Section 3 (the system description), and what help do you give?
- What is your process and timeline from kickoff to final report, and who is our day-to-day contact?
- How do you handle exceptions found during fieldwork? Can we respond before the report is final?
- Have you audited companies on our stack (for example AWS S3 or Kubernetes)? Which stack-specific controls do you test?
- What is the minimum Type 2 observation period you'll accept for our first report?
- Which annual controls (pentest, security training) must happen before the window starts?
- If we did a Type 1 with another firm, how does that affect this engagement?
- Who signs the report, and how do you sample and test against the criteria?
- What does "fast" mean in your proposal, and which steps does it shorten?
What auditors charge
| Engagement | Published range | Source |
|---|---|---|
| Type 1, small/midsize company | $7,500–$15,000 | Drata [source] |
| Type 2, small/midsize company | $12,000–$20,000 | Drata [source] |
| Type 1, 10–50 person startup | $7,000–$15,000 | BD Emerson [source] |
| Type 2 (3-month window), 10–50 person startup | $12,000–$25,000 | BD Emerson [source] |
Ranges by firm type (specialist, full-service, Big Four) are in the SOC 2 audit cost guide, sourced from soc2auditors.org and Drata. Compare quotes on the same scope: the same Trust Services Criteria, Type 1 or Type 2, and observation window.
Red flags
- The firm isn't a licensed CPA firm, or the report would be signed by an entity that isn't one (Linford & Co)
- No peer review record in the AICPA public file
- The audit comes bundled with your software and nobody can explain who chose the firm or what they're paid (Drata)
- A promised turnaround that skips fieldwork or sampling, with no explanation of what "fast" means
- Draft report language that is generic rather than specific to how your environment works (Drata)
Next: browse the SOC 2 auditor directory · get matched with auditors · SOC 2 for startups · Type 1 vs Type 2 · SOC 2 timeline
Frequently asked questions
Can any security firm issue a SOC 2 report?
No. Only a licensed CPA firm can perform a SOC 2 examination. Non-CPA specialists can assist the CPA firm, but the CPA firm issues the report and is responsible for it (Linford & Co).
Should I use the auditor my compliance platform recommends?
You can, but check independence first. Ask whether the firm pays or receives referral fees, whether the platform bundles the audit, and how the firm tests beyond the platform's dashboard. The AICPA has published guidance on business arrangements between auditors and SOC tool providers.
How many auditor quotes should I get?
There's no rule. Getting quotes from a few firms on the same scope (the same criteria, Type and observation window) is the only way to compare them like for like.
Is the cheapest SOC 2 auditor a good choice?
BD Emerson lists picking the cheapest auditor as a common startup mistake. Your customers read the report and may question a very fast or very cheap one. The AICPA has published resources on "quick-turn" SOC engagements.
When should I engage the auditor?
During readiness, not after. Firms book up, and the auditor can confirm your scope and observation window before the clock starts.
Get updates
Get the newsletter for pricing and auditor updates.
Form not loading? Subscribe on beehiiv. Or browse past issues in the archive.
Last verified 2026-10-28. Not legal or accounting advice.