Should a SOC 2 buyer choose a compliance platform or a consultant?
When a customer or bank asks for a SOC 2 report, the buyer usually needs three things: a way to prepare controls and collect evidence, a readiness consultant or in-house team to close gaps, and a CPA firm to examine the system and issue the report. A SOC 2 compliance platform can organize policies, track evidence and connect to cloud accounts, a readiness consultant can review design and sequence the work, and internal staff can do both. No tool or partner can issue, guarantee or certify the report. Only an independent CPA firm can do that, and a vendor that promises a report in days or weeks should be treated as a warning sign.
The right mix depends on three questions. First, how much capacity does your team have to write procedures, run access reviews and chase evidence every month? Second, how wide is the system in scope, and does it include cloud services, several products or additional categories beyond security? Third, can the CPA firm you plan to use also help prepare you? Under the AICPA's independence rules, a firm that helps design controls and then tests them faces limits on what it can do, so ask the firm in writing what it will and will not prepare before you sign an engagement letter. A readiness assessment done by a separate party is often the cleaner route.
Before you buy, ask each provider for a written description of what it does, what it leaves to your team and what it will not touch, such as the system description, management's assertion and the operating effectiveness testing. Ask whether the platform or consultant has any referral, fee or joint marketing arrangement with the CPA firm, and whether it expects to observe the examination or set its timing. Those arrangements are the ones the AICPA's ethics staff has flagged. Your readiness work should end with a clear list of controls owned by your staff, evidence owned by your systems and an examiner who is independent of both.
What each option can and cannot do for a SOC 2
A compliance automation platform is software that connects to your cloud accounts, identity provider, code repositories and ticketing tools. It collects configuration snapshots and access records, tracks policies and their acknowledgments, schedules access reviews and maps evidence to control descriptions. For a SOC 2, it can organize the work and reduce manual screenshot collection. It does not decide whether a control is designed well enough to meet the Trust Services Criteria, and it cannot attest that controls operated effectively. That judgment belongs to the CPA firm.
- Evidence collection: Pulls configuration and access data on a schedule and stores it against control IDs.
- Policy and training tracking: Records who received which policy and who completed which course.
- Access review workflows: Sends review tasks to managers and keeps a record of decisions.
- Gaps it cannot close: It cannot write your system description, choose your categories or accept a risk on your behalf.
- Ownership: Your organization owns every control and every policy. The vendor owns the software and its vendor-supplied content.
Before buying, ask which evidence the tool gathers automatically, which items still need a person, how it handles evidence it cannot read, and whether the vendor's content is reviewed by a CPA firm before your auditor sees it.
A readiness consultant reviews your environment against the Trust Services Criteria before the examination. A typical engagement includes a gap assessment, help scoping the system and categories, control design recommendations, coaching on what evidence the auditor will request and a remediation plan. The consultant produces findings and advice, and the organization decides what to build. A consultant cannot issue the SOC 2 report, and a consultant whose work is performed by the issuing CPA firm, or whose arrangement impairs that firm's independence, creates a conflict that the AICPA's ethics guidance addresses.
- Gap assessment: A mapping of current controls to the criteria, with gaps ranked for remediation.
- Control design support: Advice on procedures, ownership and review cadence, which you approve and run.
- Evidence coaching: Guidance on what samples look like and how to keep records the auditor can test.
- Independence limits: If the same firm writes controls and then tests them, the examination's independence may be impaired.
- Ownership: Management remains responsible for the controls, the system description and the written representations.
Before engaging, confirm whether the consultant has any relationship with your intended CPA firm, including referral or fee arrangements, and whether its deliverables will be your own documents rather than work the auditor relies on.
An in-house build means your own security, operations and compliance staff design, implement and evidence every control. This gives the organization full ownership and institutional knowledge that persists between audit periods. The trade-off is time: teams without prior examination experience usually need to learn how auditors sample, what counts as sufficient evidence and how the system description must be written. The CPA firm still issues the report, and the team still answers for every assertion made in it.
- Full ownership: Controls, policies and evidence are built around your actual systems and processes.
- Learning curve: Teams new to attestation often need time to learn sampling, exception handling and evidence standards.
- Recurring work: Access reviews, change records, vulnerability tracking and training run every period, not once.
- Staffing: Cost depends mainly on internal time and the people who carry compliance duties, which is hard to estimate without a scoped plan.
- Ownership: Your organization owns the outcome, and no outside party is accountable for gaps you miss.
Before committing, ask who on the team has run a SOC 2 before, how the plan covers Type 2 observation periods, and which tasks will need outside help, such as an independent review or a penetration test.
Why only a CPA firm can issue a SOC 2 report
A SOC 2 is an attestation examination performed by a CPA firm under AT-C section 205 of the AICPA attestation standards. The service auditor, not the organization and not any software vendor, forms and signs the opinion. Before testing starts, management must give the auditor written representations about the system description and its controls, and the auditor relies on those representations as part of the engagement. A Type 1 report expresses the auditor's opinion on the fairness of the system description and the suitability of control design as of a specific date. A Type 2 report adds an opinion on whether those controls operated effectively over a period. Either way, the opinion is the auditor's professional judgment, and a platform that generates policies, screenshots or test results cannot take over that judgment.
Most SOC 2 tool vendors are not CPA firms, so they cannot attest that controls are effective. The Journal of Accountancy warned in February 2026 that some vendors promise compliance in weeks or even hours. Compliance is not a term used in SOC 2 examinations, and there is no SOC 2 certificate to purchase. Treat any offer that promises a SOC 2 report or certification on a fixed short timeline as a reason to ask questions. Confirm with the proposed firm who will sign the report, the firm's license status, and what the vendor is contractually permitted to do. The vendor can prepare evidence, but only the CPA firm can issue the opinion, and the AICPA says service organizations should evaluate SOC services thoroughly before engaging anyone.
Who is paid for what when a platform, consultant and CPA firm are involved
This table separates the six money flows in a SOC 2 engagement, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. Use it to check that every written quote breaks out these components, because a single bundled number hides who is responsible for the report and who is responsible for the evidence. No fee amounts are stated here, since none have been published for this comparison.
| Cost component | Who is paid and for what | One-time or recurring | What drives it up or down |
|---|---|---|---|
| CPA firm examination fee | The licensed CPA firm that issues the report, for risk assessment, testing and the opinion | One-time per report, repeated for each new examination period | Type 1 or Type 2, number of categories, system scope, sample sizes, number of locations and subservice organizations |
| Readiness consultant | An outside advisor who gap-assesses controls and coaches staff, but who does not issue the report | Usually one-time project work before the first examination | Maturity of existing controls, number of systems in scope, and how much remediation the consultant is asked to perform |
| Compliance platform subscription | A software vendor for control tracking, policy templates, evidence collection and reminders | Recurring, usually annual or per seat or per integration, as the quote defines | Number of integrations, users, frameworks mapped, and whether the platform is bundled with an audit firm |
| Implementation partner for systems and evidence | A fixed-scope team that configures, hardens and documents the systems that produce evidence, under written scope | One-time project, with optional recurring retainer for upgrades and monitoring | Number of self-hosted systems, integration depth, documentation expected, and whether the work is limited to the agreed scope |
| Internal staff time | Your own engineers, security, HR and operations staff who run controls, approve changes and gather evidence | Recurring for the life of the program, with a spike during readiness | Automation of evidence collection, clarity of ownership, and how often access reviews and change records are handled manually |
| Remediation and tooling changes | Engineering effort or vendor work to close gaps found in readiness or testing | Largely one-time, with recurring upkeep | Starting control maturity, legacy systems and the number of exceptions the readiness review finds |
How to choose a SOC 2 consultant or platform without compromising the report
A SOC 2 report is issued by an independent CPA firm, so every tool or consultant you bring in has to leave that firm's independence and judgment intact. The six checks below cover who holds the license, what commercial ties exist, who controls the examination, who owns the evidence, what the vendor promises, and what is written down before work begins.
Confirm the CPA firm and its peer review
Only a licensed CPA firm can issue a SOC 2 report, so confirm the firm holds a valid license with the relevant state board and ask for its most recent AICPA peer review report and the result. Peer review is where reviewers look at how a firm uses external SOC platforms and vendor relationships, so a firm's review outcome tells you how it handles this risk. Ask the firm to walk you through its SOC practice and who will sign the report.
Disclose referral and marketing ties
Ask the vendor and the CPA firm in writing whether any cross-referral arrangement, referral fee, joint marketing terms or revenue sharing exists between them. AICPA ethics staff have flagged these arrangements as threats to independence under the Code of Professional Conduct. A consultant or platform that sends you to a particular CPA firm, or receives payment when you do, should be disclosed before you choose either party.
Keep examination fees and timing with the CPA
The examination fee, the audit timeline and the auditor's access to evidence should be set by the CPA firm in its own engagement letter, not by the provider. AICPA ethics staff flagged bundled pricing that sets the examination fee, provider rights to observe the work or set deadlines, and paying a provider to access examination evidence. Ask whether any bundled price includes the examination, and if it does, ask how the firm stays free to set its own fee and scope.
Establish who owns controls and evidence
Your organization owns its controls, policies and evidence, and the provider prepares them. Ask who designs each control, who approves the control matrix and who holds the underlying records after the engagement ends. A platform that stores your evidence should let you export it in usable form, and a consultant should not write controls that management has not reviewed and adopted. Management's assertion and representation letter must come from your own leadership.
Test vendor claims against AICPA language
Treat promises of compliance in days, weeks or hours as a warning sign. The Journal of Accountancy reported in February 2026 that SOC tool vendors may promise compliance, a term never used in SOC 2 examinations, and most newer tool providers are not CPA firms and cannot attest that controls are effective. Ask the vendor to explain what its product produces, what the CPA firm decides, and what a report can and cannot say.
Put scope and deliverables in writing
Agree in writing, before any work starts, on the systems and categories in scope, the readiness deliverables, the evidence each one produces, who performs each task and what the fee covers. A written scope lets you judge whether the work meets the examination's needs and gives you a basis for comparing quotes. Ask what happens when scope changes during readiness, and whether any work is billed by the outcome instead of the deliverable.
How the platform, consultant and CPA roles fit together through a SOC 2
This sequence shows who owns each decision and piece of evidence, so the organization can see where a platform, a consultant and the CPA firm each contribute and where they must stay separate.
Set the system and categories with management
Management defines the system, the services it supports, the locations and infrastructure in scope, and which Trust Services Categories to add to security. A consultant or platform can facilitate the discussion, but management makes and records the decision. The output is a written scope statement that the CPA firm reviews before fieldwork planning begins. You know it is done when management has signed off on the boundary and on any subservice organizations treated as carve-out.
Write the system description and map controls
Management prepares the system description against the 2018 description criteria (DC 200) and maps its controls to the relevant Trust Services Criteria, including the common criteria CC1 to CC9. A readiness consultant or compliance platform can provide templates and a control matrix, but the controls and policies must reflect how the organization actually operates. The output is a draft system description and a control matrix with a named owner for each control.
Collect evidence through platform or internal tools
Control owners run the controls and capture evidence, either through a compliance automation platform, self-hosted open-source tools, or internal ticketing and logging systems. The platform collects and organizes records such as access reviews, change tickets and training completions, and flags gaps. Management still reviews that evidence for accuracy and completeness. The output is an evidence repository organized by control, with the period and source of each record shown.
Remediate gaps and document exceptions
Where a control is missing or does not operate as written, the control owner fixes the process, updates the policy or configuration, and records the change. Consultants often help design these fixes, but the organization carries them out and keeps the records. The output is a remediation log showing each gap, the corrective action, the date it was completed and the evidence that the fix works.
Engage an independent CPA firm
Management selects a licensed CPA firm to perform the examination and agrees the engagement terms in an engagement letter. The organization should check the firm's license, its AICPA peer review status and its independence from any tool vendor it uses, and should confirm in writing who pays for and who receives access to the evidence. The output is a signed engagement letter that defines the examination type, criteria, period and deliverables.
Provide management's assertion and written representations
Management issues its written assertion about the system description and the suitability and, for Type 2, operating effectiveness of its controls, along with the written representations the AICPA attestation standards require. The CPA firm relies on these statements as part of its work. A platform or consultant may help draft them, but the signing officers must understand and stand behind every statement. The output is a signed assertion and representation letter dated to match the examination.
CPA tests controls and issues the report
The CPA firm performs its own risk assessment, tests the design and, for Type 2, the operating effectiveness of the controls, and reviews the evidence itself. Platform outputs and consultant work papers can inform this testing, but the firm decides what to test and how much to rely on any tool. When testing is complete, the firm issues the SOC 2 report with its opinion. The output is the signed CPA report, which only the independent firm can issue, and no platform or consultant can substitute for it.
Where SOC 2 vendor projects go wrong and how to avoid it
Most failed SOC 2 projects with a tool or consultant share one root cause: the buyer hands judgment to someone who cannot issue the report. The cards below cover the common ways that happens and the check that prevents each one, so the organization keeps ownership of its controls, its system description and its evidence.
Assuming the platform produces the report
A compliance platform collects evidence, maps controls and tracks tasks, but it does not attest to anything. The CPA firm that signs the report tests whether controls were designed and operated as described, over a period for a Type 2. Before buying, ask the vendor in writing which parts of the work it performs and which parts the CPA firm performs, and confirm that the CPA firm has accepted the tool's evidence approach.
Letting a vendor dictate the examination
Some vendors try to set how the examination is performed, including scope, sampling, timing and which evidence the auditor may request. The AICPA's SOC 2 Working Group chair has said such vendors often lack an understanding of the professional standards. Management should decide scope and control design with its CPA firm, and any vendor input should be recorded as advice that management and the auditor can accept or reject.
Signing a bundle that ties the fee to a tool
Bundled pricing that sets the examination fee, or a referral arrangement between the tool provider and the audit firm, creates an independence problem. AICPA ethics staff flagged these terms in 2026 as raising threats under the Code of Professional Conduct. Ask for separate written quotes for the tool and the examination, and ask the CPA firm whether it receives any fee, referral payment or joint marketing income from the vendor.
Paying the provider for evidence access
Some arrangements require the organization to pay a tool provider so the auditor can reach examination evidence, or give the provider rights to observe fieldwork. Evidence belongs to the organization and should be available to the CPA firm directly. Before signing, confirm in writing that the auditor can access every evidence source without a vendor fee, and that the organization can export its records if it changes tools.
Treating a bridge letter or badge as a report
A trust badge on a vendor's website, a SOC logo or a bridge letter is not a SOC 2 report. A bridge letter is a statement from the service organization's management covering the gap after the last Type 2 period, and it does not replace the next report. Ask for the CPA firm's signed report with its opinion and date ranges, and check that the report period covers the time your customer is relying on.
Leaving control ownership with the vendor
Controls are the organization's own. A vendor can draft policies, configure alerts and run reviews, but management must approve the policies, perform access reviews, respond to incidents and be able to explain each control to the auditor. Assign a named owner to every control in the matrix, and make sure your staff can run the process after the engagement ends, without the vendor's dashboard or consultant.
Questions buyers ask before hiring a SOC 2 consultant or buying a platform
Can a compliance platform get us a SOC 2 report?
No. Only an independent CPA firm can examine your controls and issue a SOC 2 report. A platform can help you collect evidence, track tasks and map your controls to the Trust Services Criteria, but it cannot attest that those controls are effective. The Journal of Accountancy reported in February 2026 that most SOC tool providers are not CPA firms and therefore cannot attest to control effectiveness. Your organization owns its controls. A platform or implementation partner prepares systems and evidence, and the CPA firm forms the opinion.
Can the same firm prepare us for SOC 2 and then audit us?
It depends on the independence rules that apply to that firm. The AICPA's Ethics Staff warned in April 2026 that business arrangements between CPA firms and SOC 2 tool providers can create significant threats to compliance with the Code of Professional Conduct. The rules cited include the Independence Rule (ET 1.200.001) and the independence standards for SSAE engagements (ET 1.297). Ask the CPA firm in writing which readiness work it may perform, who will prepare the system description, and how it documents independence. A readiness provider that is separate from the examining firm avoids much of this question.
Can we run a SOC 2 examination in-house?
Yes, the organization can run the program internally, but the examination itself still requires an independent CPA firm. In-house teams own the controls, write the policies, operate the tooling, collect evidence and draft the system description. The gaps usually appear in readiness, where teams need to interpret the criteria, decide scope and fix control design before the examination starts. Many organizations use a readiness consultant for a short review while keeping day-to-day operation in-house. Confirm with your chosen CPA firm which documents it will accept from you and how it wants evidence delivered.
What does the work need from our team?
Expect ongoing time from engineering, operations, HR, legal and leadership, not only from the security team. Engineering owns system configuration, access, logging and change records. HR supplies joiner and leaver records and training evidence. Leadership approves policies, risk decisions and the management assertion. Someone must own the program day to day, meet the evidence requests and keep the control matrix current. Ask any platform or consultant to show you which tasks it performs and which remain with your staff, so that the time commitment is clear before you sign.
How long does a SOC 2 take from start to report?
The duration depends on your scope, how mature your controls already are, whether you need a Type 1 report or a Type 2 observation period, and how quickly your team responds to the CPA firm. Our SOC 2 timeline guide walks through each phase, from scoping and readiness to fieldwork and report issuance. Be cautious of any vendor that promises a report in days or weeks. The AICPA has publicly warned that fast and easy promises threaten the credibility of SOC reports.
Can a vendor give us a SOC 2 certificate?
No. A SOC 2 is an attestation report issued by a CPA firm, not a certificate, and no vendor can issue one. Vendors that claim you are SOC 2 certified or compliant in a few days are making a claim the examination process does not support. Ask for the CPA firm's name, its license status and a copy of the report or the report timeline. The AICPA logo appears only in accordance with its rules for the report, so treat marketing badges as a prompt for questions, not proof.
What should a SOC 2 quote include?
A written quote should list the scope, the deliverables and the responsibilities of each party. Ask for the systems, services and locations covered, the Trust Services Criteria categories included beyond security, and whether cloud providers are handled inclusively or as carve-outs. It should name the CPA firm's fee separately from any readiness, remediation or tooling work, state whether the price covers a Type 1 or Type 2 report, and say which tasks your staff must complete. Confirm whether the provider has any referral, revenue-sharing or joint marketing arrangement with the CPA firm, and whether it expects to observe examination work or access evidence through the platform. Those arrangements are exactly what the AICPA's ethics staff flagged in April 2026.
How DeployOpen prepares your systems and evidence for a SOC 2 examination
DeployOpen is a Chainscore Labs company that plans, implements, hardens and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a SOC 2 engagement, that means the systems that run your controls, such as access management, logging, backup, change pipelines and ticketing, are built to produce the records a CPA firm will ask for. Our work covers the platform side: configuration baselines, access roles, log retention settings and the evidence exports that show a control operated. It does not replace the decisions your organization must make about its own policies, risks and owners.
Every engagement is fixed-scope. Before work starts, we agree in writing the systems in scope, the deliverables, the timeline and who on your side approves each step. That document is the reference point when a scope question comes up during the examination. Ask any partner, including us, for the same thing: a written statement of what they will build and what they will not. Confirm early whether the engagement includes readiness testing of controls, evidence collection or only platform hardening, because those are different amounts of work and should be priced separately in the quote.
The boundaries matter as much as the deliverables. DeployOpen does not issue SOC 2 reports, attestations or certifications. Only an independent CPA firm can do that. We also do not set the CPA firm's fee, decide what evidence the auditor may access, or dictate the examination timetable. Your organization owns its controls, its system description and its management assertion. Ongoing support, upgrades and periodic control testing between examinations are available as a retainer, which suits organizations running a Type 2 observation period. Before signing, confirm with your CPA firm that the evidence we produce matches what it intends to test.
