How do you choose a SOC 2 auditor that customers will accept?
When a customer, bank or contract now requires a SOC 2 report, someone has to choose the CPA firm that will issue it. Only an independent CPA firm issues a SOC 2 report, so the choice comes down to three things: whether the firm holds a valid license, whether it is enrolled in the AICPA Peer Review Program and what its latest review found, and whether it is independent of the organization and of the tool vendors involved. The organization owns its controls. A partner such as DeployOpen prepares the systems, controls and evidence, and the CPA firm plans the testing, samples the evidence and forms the opinion. Keeping those roles separate is what makes the report worth reading.
Start by checking the firm before comparing prices. Verify each practitioner's license in CPAverify, the free license search hosted by NASBA, which flags state board disciplinary actions. Then confirm peer review enrollment in the AICPA Peer Review Public File and read the most recent accepted review, paying attention to whether the result was a pass, a pass with deficiencies or a fail. Ask how many SOC 2 examinations the firm has issued in the past year, who on the engagement team has done them, and how it samples evidence, since those answers reveal capacity and depth. The Journal of Accountancy's February 2026 guidance also recommends asking how the firm maintains independence from any compliance platform it is referred to.
The right firm depends on your own scope. A single-product SaaS company, a bank's payments provider and a self-hosted platform running in a client's cloud account each present different system boundaries, report types and sector expectations, so the firm needs experience with that profile. Confirm which Trust Services Criteria categories are in scope, whether the firm is comfortable with carve-out or inclusive treatment of cloud providers, and whether your customers' regulators or bank reviewers expect a particular format. Ask for a written engagement letter that states the scope, deliverables and fees before any work starts, and treat a firm that promises a report in days or weeks as a warning sign.
What to verify before you shortlist a SOC 2 auditor
The checks run in a fixed order, starting with licensing and peer review status, so that only firms with verifiable credentials and a clean review history reach the reference and experience conversations.
Confirm the firm's license with CPAverify
Search the firm name and the individual partner who will sign the report in CPAverify, the free license search hosted by NASBA. It is built on official data from 53 participating jurisdictions and shows license status and any state board disciplinary actions. Your procurement or security team runs the search, not the vendor. The step is complete when you have saved the search result for each named practitioner and the firm, with the date you checked. A firm or person that cannot be found, or whose license shows disciplinary action, drops off the shortlist. The AICPA says it refers unlicensed firms and practitioners to state boards of accountancy.
Confirm peer review enrollment publicly
Look up the firm on the AICPA Peer Review Public File, which lists enrolled firms and their enrollment status. Confirm the firm is enrolled in the AICPA Peer Review Program, not merely that it claims to be. Firms in the program must have a peer review once every three years. A firm that is not enrolled, or whose status you cannot confirm, should be asked for an explanation in writing before it moves forward. The output of this step is a recorded enrollment status for each candidate.
Read the latest accepted peer review results
Where the Public File shows the latest accepted peer review documents, read the report rating. Reviews are rated pass, pass with deficiencies or fail. A pass with deficiencies is not automatically disqualifying, but you should read which deficiencies were noted and whether the firm describes the corrective actions. A fail rating or an unexplained gap in review history is a reason to remove the firm. Ask any firm whose documents are not public to provide its most recent accepted review letter directly. Record the rating and review date for the shortlist file.
Check SOC 1 and SOC 2 engagement coverage
Confirm that the firm's peer review covered its attest work. SOC 1 and SOC 2 examinations are must-select engagements in a system review when applicable, so a reviewer should have examined at least one such engagement. Ask the firm to confirm which of its SOC engagements were selected in the most recent review and whether the review noted findings against them. Keep the answer in writing. The output is confirmation that the firm's recent examination work was itself reviewed, which shows that a peer reviewer looked at how it performs these examinations.
Assess size, capacity and staffing
Ask how many SOC 2 examinations the firm runs each year, how many are in progress, and which partner and senior staff will do the fieldwork on your engagement. Ask who reviews the work before the report is issued. A firm that issues a very large number of reports with a small team is a warning sign the Journal of Accountancy describes in its 2026 advice. Your question is whether the people named in the proposal will have time for your system. The output is a named team and a written capacity commitment you can hold the firm to.
Verify references and examination experience
Ask for references from organizations with a similar system, a similar service model and, where relevant, a similar customer base. Speak with at least two of them about timing, the quality of the evidence requests, how the firm handled exceptions, and whether the report was accepted by their customers. Also ask how the firm tailors testing to your environment rather than producing a standard template. Reports that look the same apart from the client name are a warning sign. The output is a short written note on each reference call, kept with the shortlist file.
Document the shortlist decision
Summarize each candidate in one table with the license check date, enrollment status, peer review rating, review date, engagement coverage, capacity answers and reference notes. Mark each firm as shortlisted, held for clarification or removed, with the reason. Share the table with the security and compliance leads who will work with the auditor. The step closes when the shortlist is approved and the firms that remain can be asked for independence confirmations and a scope proposal.
How to read a license check and a peer review result
Two free public registers tell you whether a CPA firm is licensed and enrolled in peer review, and the review rating tells you how its quality work has been judged. Read them together before you sign an engagement letter, since only a licensed CPA firm can issue the SOC 2 report you need.
License status and disciplinary flags
CPAverify, hosted by NASBA, is a free license search for CPAs and accounting firms built on official data from 53 participating jurisdictions. It shows license status for individuals and firms and flags state board disciplinary actions. Search the firm and the individual partner who will sign the report, then compare the names and states against the firm's proposal. Ask the firm which state licenses cover the engagement and why any state is missing.
Peer Review Program enrollment
The AICPA Peer Review Public File lists firms enrolled in the Peer Review Program and their enrollment status. Enrollment is the baseline for a firm that performs attest work such as SOC 2. Confirm the firm's legal name matches the name on the report, and ask about any changes of name, merger or ownership since its last review, because the register may show an older entity.
What the review rating signals
Each peer review ends in a rating of pass, pass with deficiencies or fail. SOC 1 and SOC 2 examinations are must-select engagements in a system review when applicable, so a reviewer will have examined this kind of work. A pass with deficiencies is not automatically disqualifying, but ask which deficiencies were found, whether they affected attest engagements and what the firm changed afterward.
The latest accepted review documents
The public file shows the latest accepted peer review documents for firms in PCPS, EBPAQC or GAQC, and for firms that choose to make them public. Read the report and its letter of comments, not only the rating. Check whether the review covered the office and staff that will do your fieldwork, and whether the review date is recent. If the firm does not publish its documents, ask for them directly before you decide.
If a firm is not enrolled or unlicensed
The AICPA says it will act against members who did not follow professional standards, were not enrolled in peer review or were unlicensed, and it refers unlicensed firms and practitioners to state boards of accountancy. A firm that cannot show enrollment or a license for the engagement should not be engaged for a SOC 2. Report concerns to the relevant state board, and do not accept a report from the firm as a substitute for a valid examination.
Which kind of provider fits your SOC 2 need
This table compares a CPA firm that issues the SOC 2 report, a readiness consultant or compliance platform that prepares evidence, and an in-house team. Read each column to see who can sign the report, what each option can do, and where independence limits apply if one firm both prepares the controls and tests them. Only a licensed CPA firm issues the report.
| Provider type | Who issues the report | What it can do | Independence limit |
|---|---|---|---|
| CPA firm (examining firm) | Yes, the only party that issues the SOC 2 report and opinion | Plans the examination, tests controls, samples evidence, obtains written representations, and signs the report | Must remain independent of the systems it tests; confirm what advice it can give before engagement |
| Readiness consultant | No | Maps controls to the Trust Services Criteria, identifies gaps, helps write policies, and supports evidence collection | Cannot issue the report; if the same firm later tests the controls it designed, the independence question must be answered in writing |
| Compliance automation platform | No | Collects configuration data, tracks tasks and policies, and stores evidence for the auditor | Cannot issue the report; a tool vendor that also refers or sells audit work raises independence questions to confirm |
| In-house team | No | Owns the controls, runs daily operation, produces evidence, and prepares the system description and management's assertion | Management remains responsible for the description and assertion; the CPA firm still performs the independent test |
| Fractional security leader | No | Sets priorities, coordinates owners, and reviews evidence quality before the auditor arrives | Advisory role only; confirm that the same person is not also acting as the auditor's reviewer |
| Fee-based referral platform | No | Connects buyers with audit firms and may offer quick-turn packages | Ask who pays whom and whether the firm is chosen for the buyer or for the referral; the AICPA has warned about this model |
Questions to ask a CPA firm, by role
The executive owns the budget and the decision to engage a firm, so the questions focus on whether the firm is licensed, large enough to meet your timeline, and clear about what it will and will not do. Ask for the firm's license status first, then check it yourself through the free CPAverify search rather than relying on the firm's own documents.
- Licensure and standing: Which licensed CPAs will sign the report, and in which states are they licensed? Confirm each one in CPAverify.
- Capacity: How many SOC 2 examinations does the firm run each year, and how many does your engagement partner lead at the same time? Ask who will staff your fieldwork and whether that team stays fixed.
- Reference clients: Can the firm name two or three clients in your sector that it has examined, and will it connect you with one of them?
- Fee structure: Does the quote separate the examination fee from readiness work, retesting and any extra periods? Ask which costs recur each year and which are one-time.
- Independence: Will the firm also help you prepare, or sell you tools? Ask how it keeps those roles apart.
Check that the quote names the scope, categories and report type in writing before you compare numbers across firms.
The compliance lead runs fieldwork, so the questions focus on how the firm tests controls, what it samples, and how it handles exceptions. Good answers are specific to your systems and explain the firm's method in plain terms. Ask for a sample evidence request list and a description of how the firm will obtain evidence from your ticketing, identity and cloud systems.
- Examination scope: Which systems, locations, services and trust services categories will the firm test, and which subservice organizations will be included or carved out?
- Sampling approach: How does the firm choose samples for Type 2 testing, how many items does it expect for recurring controls, and how does it handle populations it cannot fully export?
- Evidence handling: Will the firm accept system-generated reports, screenshots or exported logs, and how does it check that evidence is complete and unaltered?
- Exceptions: How does the firm document control deviations, and how does it discuss them with management before the report is issued?
- Tool use: If you use a compliance platform, will the firm rely on its outputs, and will it test the underlying controls directly?
Ask the firm to walk through a recent example of a control exception, anonymized, to see how it reasons about severity and wording.
Procurement compares firms on verifiable facts, so the questions focus on peer review, quality controls and the terms of the engagement letter. Ask each firm to provide its peer review documents and enrollment status, then verify them independently. The AICPA's Peer Review Public File lists enrolled firms and their enrollment status, and it shows accepted peer review documents for some firms.
- Peer review: Is the firm enrolled in the AICPA Peer Review Program, when was its last review, and what was the rating (pass, pass with deficiencies or fail)?
- Quality warnings: Does the firm make promises of a report in weeks or hours, or reference thousands of reports a year? Those are warning signs the Journal of Accountancy described in February 2026.
- Engagement letter: What does the letter cover, including deliverables, timing, what the firm needs from you, fee terms, and how the firm handles delays caused by your team?
- Report terms: Who may receive the report, and does the firm place any restrictions on its use or distribution?
- Contract exit: How are records transferred if you change firms, and what happens to open testing if the engagement ends early?
Request the engagement letter draft before you shortlist, and compare the scope and fee terms line by line across all firms.
Red flags the AICPA and Journal of Accountancy have described
The AICPA and the Journal of Accountancy have both warned service organizations about the same pattern: fast, cheap and high-volume SOC 2 offers that sit uneasily with the professional standards a CPA firm must follow. Each card below describes one warning sign, what to ask the firm, and how to verify the answer before you sign an engagement letter.
Compliance promised in weeks or hours
The Journal of Accountancy lists promises of compliance in weeks or hours as a warning sign. A SOC 2 examination depends on the system description, the controls operating over time for a Type 2 report, and fieldwork the CPA firm performs itself. Ask the firm to walk you through its planned fieldwork dates, what it needs from you, and how it samples evidence. Compare the answer with the timeline in the SOC 2 timeline guide. If a firm cannot explain its own steps, treat the promise as a red flag.
Marketing that cites thousands of reports
Referral marketing that alludes to thousands of SOC 2 reports a year signals volume, not care. A single partner cannot personally test that many engagements, so the work is likely templated or delegated. Ask how many engagements the partner signs each year, who performs fieldwork, and what review happens before the report is issued. Check the firm's size and capacity against the claim, and ask for references from clients of similar size and industry.
Reports identical except for the logo
A SOC 2 report describes one organization's system, services, controls and test results. The Journal of Accountancy flagged reports that are all the same apart from the client logo as a warning sign. Ask the firm for a sample report from a comparable engagement, with client details redacted, and check that its system description, tests and exceptions read as specific to that organization. A firm that tailors the examination to your system should be able to explain how the scope and testing differ from its other work.
Referral platforms promising outcomes
Referral platforms that promise clients favorable outcomes put the firm's independence at risk. An auditor must reach its own conclusions, so a referral arrangement tied to results is a conflict the buyer should not accept. Ask whether the firm pays, receives or shares fees with any referral platform or tool vendor, and whether that arrangement affects the report. Ask how the firm maintains independence from any vendor that also sells you software or readiness services.
Anonymous allegations about practices
The AICPA says it is looking into anonymously published allegations about a SOC compliance vendor's business practices. Anonymous claims are not proof, but they are a reason to verify before you hire. Confirm the firm's license with CPAverify, check its enrollment and most recent peer review result in the AICPA Peer Review Public File, and ask the firm directly how it has responded to any public concerns. Where the AICPA finds a firm did not follow professional standards, it says it will act, and unlicensed firms are referred to state boards of accountancy.
Why independence from tool vendors affects your report
The AICPA has raised concern about independence risk when a CPA firm that issues a SOC 2 report also has business arrangements with the compliance tool vendor whose platform generated the evidence. The concern is general: if the auditor is paid through referrals, shares ownership with a vendor, or is steered toward a preferred vendor, a reader of the report has less reason to trust that the examination was carried out independently. Before you sign an engagement letter, ask the firm directly whether it receives referral fees or other payments from any tool vendor, whether it or any of its owners holds an interest in one, and whether it has preferred-vendor or co-marketing arrangements that affect which platform you are steered toward. Ask for the answers in writing and keep them in your vendor file.
The practical test is whether your customers can rely on the report. A SOC 2 is only useful to a buyer's vendor review if the examining firm is independent of the systems it examines and of the vendors that prepared the evidence. If a bank's third-party risk team later finds a referral arrangement, the report may be questioned, asked to be re-performed, or rejected, and the cost lands on you. Ask how the firm keeps its independence from tool vendors, how it handles any vendor that also supplies your evidence, and who on the firm's side approves independence decisions.
The Journal of Accountancy published guidance in February 2026 on vetting CPA firms, including questions about independence, and the AICPA's position on these arrangements may be updated after that date. Read the current guidance directly from the AICPA before you finalize selection, and confirm with the firm how it applies that guidance to your engagement. DeployOpen prepares systems, controls and evidence for an assessment, but it is not the independent examiner and does not issue reports. Your CPA firm is the party that should answer independence questions for the examination.
Questions buyers ask when hiring a SOC 2 auditor
How much does a SOC 2 auditor cost and what drives the fee?
The CPA firm's fee is set by the scope of the examination, not by a published rate. The main drivers are whether you want a Type 1 or Type 2 report, how many trust services categories you add to security, how many systems, locations and subservice organizations fall in scope, and how much evidence the firm must sample. The fee is recurring in the sense that a Type 2 report needs a new examination each period. Readiness work, remediation, tooling and internal staff time are separate costs that a CPA firm does not price for you. Ask each firm for a written fee proposal that lists the report type, categories, systems, observation period, sampling approach, and any fees for re-testing or additional letters. Compare proposals on the same scope, and treat a much lower quote as a question to resolve, not a saving. The AICPA has warned about offers that promise fast, cheap reports.
How long does it take to select an auditor and get fieldwork started?
Selection itself is usually the shortest step, but the reader's readiness determines when fieldwork can begin. Before you sign, confirm the firm's license, peer review enrollment and capacity to start on your schedule. Then you must provide a scope statement, a system description draft, your list of controls, policies, and evidence from the observation period. For a Type 2 report, the observation period has to have run before the examination can close, so the firm's calendar cannot shorten it. Ask the firm for its expected timeline, the evidence request list it will send, and the dates it needs your management representations. Any firm promising a report in days or weeks should be questioned on how it plans to test operating effectiveness over a period.
Can the same firm prepare us for SOC 2 and then test our controls?
Generally, the firm that issues the report should not also design and implement the controls it will test, because that creates an independence problem. The AICPA's attestation standards require the service auditor to be independent of the client. Some firms offer readiness reviews, and the accounting profession treats that as a threat to independence that must be assessed. Before engaging anyone, ask the firm in writing how it manages independence, which services it provides to you, and whether the people who prepare you are different from the people who test you. Use a separate readiness consultant if you need hands-on help, and confirm the auditor is comfortable with that split.
Can we pick an auditor without hiring a consultant first?
Yes. Many organizations select a CPA firm directly and run their own readiness work, but this works only if someone internal can map controls to the Trust Services Criteria, collect evidence consistently and explain the system clearly. A consultant is optional. What you cannot skip is the independent CPA firm, because only a licensed CPA firm can issue the report. Before selecting, ask the firm what it needs from you, whether it provides a sample evidence list, and how many months of prior evidence it expects for a Type 2. If your team cannot answer those questions, a readiness assessment may save time, provided it is done by someone other than the issuing firm.
What should we do if a customer does not accept our chosen CPA firm?
First ask the customer what it is testing for. Many customers accept any CPA firm that is licensed and enrolled in the AICPA Peer Review Program, and they may only need the firm's name and license status confirmed. If the customer names a specific firm or rejects an unfamiliar one, ask for its written reasons and whether it has a published requirement. Do not switch firms only to satisfy a single request without checking the new firm's license, peer review result and capacity. Keep the report type, scope and period in the contract, and document the customer's acceptance criteria so that the next examination does not restart the discussion.
Is there such a thing as a SOC 2 certificate?
No. A SOC 2 is an attestation report issued by an independent CPA firm, with opinions on the system description and on the controls as of a date (Type 1) or over a period (Type 2). It is not a certificate, and no organization can be certified SOC 2 by a vendor, a platform or a consultant. Be wary of claims that a company is SOC 2 certified or compliant in days, and ask for the CPA firm's name and the report period. The AICPA also licenses use of its logo under its rules, so the logo alone does not prove an examination took place. Verify the firm and the report directly.
What is a bridge letter and when do customers ask for one?
A bridge letter, sometimes called a gap letter, is a statement from the service organization's management, not from the CPA firm, that covers the period between the end of the last SOC 2 Type 2 observation window and a later date. Customers ask for one when their vendor review falls after the report period ends. The letter should say what management represents about changes, incidents and control performance in that gap. It does not replace the next report, and the CPA firm does not issue it. Ask your auditor whether it will review the letter wording, and make sure your management team, not the firm, signs it.
How do we check a CPA firm's license and peer review in minutes?
Start with the free CPAverify search, hosted by NASBA, which draws on official data from 53 participating jurisdictions and shows license status and state board disciplinary actions. Then check the firm in the AICPA Peer Review Public File to confirm it is enrolled in the AICPA Peer Review Program and to read its latest accepted peer review documents, where the firm has made them public. Look for a pass result, and ask about any deficiencies. Confirm that the individual CPA signing the report is licensed too. If a firm is not enrolled or cannot show a license, the AICPA says it refers such cases to state boards of accountancy, so do not engage it. Save screenshots or PDFs of both checks for your vendor file.
How DeployOpen prepares you for the auditor you choose
DeployOpen is a Chainscore Labs company. We plan, implement, harden and document self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and we prepare the systems, controls and evidence that a compliance assessment will examine. We do not issue SOC 2 reports, attestations or certifications, and we do not decide the auditor's opinion. Only the independent CPA firm you select can do that. Our role is to make sure that when the firm arrives, the environment it tests is documented, configured and ready to be sampled.
Before you engage us, confirm that the CPA firm you have chosen is independent of DeployOpen. Ask the firm to state in writing whether it has any arrangement with us, whether it refers clients to us or receives referral fees, and whether it has previously prepared the systems it would later test. Check the firm's license and peer review status first, as covered elsewhere on this page, then ask for its independence confirmation as part of the engagement letter. If the firm objects to a readiness provider working on the same environment, that is a decision to settle before scope is agreed, not after the report is drafted.
Our engagements are fixed-scope. Before work starts, we agree the systems in scope, the deliverables, the timeline and our responsibilities in writing. At the end, we hand over an evidence package the chosen firm can review on its own terms: the system description inputs, the control matrix mapped to the criteria, configuration exports, access review records, change tickets, and the remediation log. We will not select which samples the auditor pulls or edit records after the fact. Ask the firm which evidence format it prefers and whether it wants a walkthrough before fieldwork, and confirm both in writing so the handover matches what the auditor will actually request.
