How to choose a SOC 2 auditor: questions to ask before you sign

Updated 25 October 2026

Only a licensed CPA firm can issue a SOC 2 report, so your choice is between CPA firms, not between a firm and a software platform or a consultant. Pick on six things: the firm's independence from you and from whoever referred you, its experience with companies of your size and stack, how well it fits your scope, its timeline, what the fee includes, and how it tests. The core of this page is a list of questions to put to every firm in writing before you sign.

Who can issue the report

A SOC 2 report is an attestation: a licensed CPA firm examines your controls against the Trust Services Criteria and writes an opinion. A-LIGN says a SOC 2 audit must be completed by an external auditor from a licensed CPA firm (A-LIGN), and the AICPA describes SOC as a suite of services CPAs may provide in connection with a service organization's system-level controls (AICPA). A-LIGN also notes that many SOC 2 software providers only offer a solution to assess your readiness (A-LIGN). A platform, template set or consultant can prepare you; none of them can issue the report, and the report is not a certificate you can frame.

The first question to every firm is therefore the plainest one: are you a licensed CPA firm? HiComply goes further and suggests confirming the license and asking when the firm's last peer review was (HiComply).

Settle your own scope first

Firms can only quote what you can describe. Before the first call, decide three things, even if you change them after hearing the firm out:

• Criteria. Security is the base, and Availability, Confidentiality, Processing Integrity and Privacy are optional. See which Trust Services Criteria to include.
• Type I or Type II. A Type I looks at the design of your controls on one date; a Type II tests whether they operated over a period. See Type I vs Type II, and if a customer set the deadline, what to tell them while you plan.
• Period and start date. For a Type II, the length of the window and when it opens. See the observation period guide and the timeline planner for a dated plan whose durations are assumptions you can change.

If you are unsure, say so and ask each firm what it recommends. A firm's answer to "what would you recommend for a company like ours?" tells you as much about its experience as the recommendation itself.

Questions to ask every firm

Send the same list to each firm and ask for written answers, so you compare answers rather than sales calls. Questions with a source link come from that publisher's published list or advice. Treat the sources as what they are: several are written by vendors that sell a platform or a service, and one list (Drata's) assumes you use its dashboard, so those items are adapted here.

Licensing, independence and conflicts

• Are you a licensed CPA firm, and can you confirm it in writing? (A-LIGN) (HiComply)
• When was your last peer review? (HiComply)
• Do you or your staff have any conflicts of interest that would impair your independence? (Schneider Downs)
• Who referred us to you, and do you have a commercial arrangement with that party? (See the independence and platform sections below.)

Report type, categories and the system description

• Which Trust Services categories would you recommend for a company like ours? (Drata)
• Should we pursue a Type I or a Type II report? (Drata)
• Do we write the system description, or do you? (Drata) The system description template shows what management usually drafts.
• Will you help define what the report covers, what is excluded and which controls are tested? (Schneider Downs)

Timeline and the Type II period

• What are the steps from planning to report delivery, and how long does each take? (A-LIGN) (Drata)
• What is the minimum Type II period you will examine? (Drata)
• How do you treat annual controls we performed before the period starts? Drata's own example is a penetration test and training done in December, ahead of a January to June period (Drata). Ask whether the report would change for controls not performed inside the period, and whether anything short of re-performing them is accepted.
• When can you start, and does your busy season change the timeline? HiComply says Q1 and Q4 peak seasons can extend timelines (HiComply).

How they test

• How would you test our specific stack, and which controls matter most for the services we run? (Drata)
• How does evidence collection work, and what tool do you use for requests? A-LIGN says evidence collection can involve hundreds of requests for evidence (A-LIGN). Ask for the request list format and a sample, and compare it with the evidence checklist.
• Can the engagement run fully remote? (Schneider Downs)
• Can you walk us through your methodology? (Schneider Downs) Then rehearse the walkthrough with the auditor interview prep sheet.

Exceptions and communication

• How will we learn of an exception, and can we discuss results before the final report is issued? (Drata)
• How do you handle exceptions, and what follow-up do you document? (HiComply)
• Who is our named point of contact, and how often will we hear from you? (HiComply) (Schneider Downs)

Who does the work

• Who leads our engagement day to day, and what is the experience level of the fieldwork team? (HiComply)
• Do you use subcontractors, where are they, and do they maintain the same security controls as you? (Schneider Downs)

Fees and what is included

• Is the fee fixed? What would raise the price or the timeline? (HiComply)
• What additional fees might apply, and what will later years cost? (Schneider Downs)
• Is a readiness assessment included or billed separately? (HiComply)
• What does a re-test cost, and when is one needed?

After the report

• What happens after the report is delivered? (HiComply)
• How long is the report useful to customers, will you help with a bridge letter, and what does renewal look like? (Schneider Downs) The bridge letter template covers the gap between periods.
• Can we put the items we care about into the engagement letter? (Schneider Downs)

Fit: size, stack and references

Scrut's advice is to check for similar SOC audits in your niche and for companies of your size, to test whether the auditor understands your tools, and to choose a communication style that fits yours (Scrut). HiComply adds the same point from the buyer's side: look for a firm that has worked with companies like yours at your growth stage, and ask for case studies (HiComply). A-LIGN warns that an inexperienced choice can end in a report that no one accepts (A-LIGN).

• Ask how many SOC 2 examinations the firm completed in the last 12 months (HiComply), and in which industries (A-LIGN).
• Ask for client references and call them. Ask how the firm handled delays, scope changes and disagreements.
• Ask whether the firm has worked with your hosting provider, source control and identity tools. A firm that has never seen your stack will spend your hours learning it.
• If your team is very small, say so on the first call. See SOC 2 for a team of 1 to 10 for the duties a firm will ask you to explain.

Comparing quotes on the same terms

A quote only compares with another if both describe the same engagement. The cost guide lists the facts to send every firm (report type, criteria, period, system and team, what the fee includes and what you must provide) and the published fee ranges with their sources, so they are not repeated here. Add these to the comparison:

• Whether readiness work, a gap assessment or a mock walkthrough is in the fee or extra.
• Who writes the system description and who collects evidence, since either can add hours on your side.
• What a re-test or a changed scope costs, and whether the next year's renewal is priced now.
• Whether the Type I and Type II are priced together or separately.
• The earliest start date and the date the firm expects to issue the report.

Put one row per firm and one column per criterion, and weigh the columns that matter most to you. The gap assessment template gives you the baseline you will want in hand when quotes arrive, because every firm will ask where you stand.

Independence: when one firm advises and examines

Firms differ on whether the same firm should prepare you and then examine you. HiComply strongly recommends a readiness assessment, ideally with the firm conducting your actual audit (HiComply), and does not discuss independence in the article. Schneider Downs' pre-contract question list includes a conflicts-of-interest question and a question about how often the firm issues qualified or adverse opinions when it also performed a readiness assessment (Schneider Downs). A-LIGN describes using a separate audit vendor as leaving room for things to be lost in translation (A-LIGN). None of the sources explains the independence rules themselves, and this page does not either.

So ask, and write down the answer:

• Does the firm provide advisory or readiness services, and to whom?
• If it does, how does it separate that work from the examination, and who signs off on each?
• Does it have any financial or referral relationship with a platform or consultant you use?
• How often has it issued a qualified or adverse opinion after doing readiness work for the same client?

Red flags the sources name

None of these proves a firm is wrong for you; each is a reason to ask a follow-up question.

• A suspiciously low quote, which HiComply says may signal scope cutting or junior staff doing the fieldwork (HiComply). Scrut similarly warns about low prices that hide substantial costs (Scrut).
• No relevant case studies or references, and a generic system description that could fit any SaaS company (HiComply).
• A promise of a favorable report before the engagement starts (HiComply). The firm forms its opinion after testing, so treat any promised outcome as a warning.
• Exceptions found without documented follow-up, or a firm that becomes unavailable after the report is issued (HiComply).
• A "14-day audit" claim without a clear explanation. A-LIGN says such a timeline is an estimate for an expedited evidence collection process (A-LIGN).
• A vendor that only offers readiness tooling, which A-LIGN says many software providers do (A-LIGN). Ask which licensed CPA firm will sign the report.

If a platform recommends an auditor

Some compliance platforms bundle, refer or recommend auditors. Scrut, for example, says it provides a pre-negotiated marketplace of independent and affiliated auditors, and its article does not describe how that works or how terms are negotiated (Scrut). That is the platform's own offer, and the sources fetched for this page do not say whether it is a good or a poor deal for the buyer. A referral can save time. It also raises the same independence and price questions as any other relationship, so ask:

1. Is the firm independent of the platform, and is there a referral fee or revenue share between them?
2. Who signs the engagement letter, you or the platform, and who is invoiced?
3. Is the quoted fee the firm's standard fee, or a negotiated one? Ask for a standalone quote too.
4. Can you use another firm and still use the platform? What happens to your evidence if you leave?
5. Does the firm's question list assume the platform's dashboard? Ask what it tests when it does not.

Even with a referral, get at least one other quote on the same terms. The cost guide explains why no platform is required by the criteria.

How many firms to talk to

Scrut says to talk to at least four prospective auditors (Scrut), without giving a reason. Policyseed's customer-request guide suggests two or three. No source here shows evidence for either number. A practical rule: keep talking until you have two quotes on identical terms and a reference call for the firm you lean toward.

Where Policyseed fits

Policyseed is not a CPA firm, is not affiliated with one or with the AICPA, and does not recommend or rank firms. It helps with the part before and between conversations. The free generator renders the 22 policies a SOC 2 examination expects from 23 questions, in your browser with no signup, and the readiness assessment gives you a baseline to bring to the first call. The Audit Kit ($59, one time) puts the policies in your company's name as editable Word files and adds audit-prep drafts such as a system description, a gap assessment and a timeline. Management reviews and approves them; the firm you choose forms its own opinion.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.