Can your SOC 2 auditor also do your readiness work

Can your SOC 2 auditor also do your readiness work, and where is the limit?

A customer or contract now requires a SOC 2 report, and you are considering whether the CPA firm that will issue it can also run your readiness work. The short answer is that the firm may provide some nonattest services only if the AICPA Code's conditions are met and its independence is preserved, and it cannot be the party that both builds your controls and then attests to them without evaluating that work. Whether any of this is permitted depends on the specific services the firm offers, the scope of the examination and whether a tool provider sits in the arrangement. Your organization owns its controls and the system description. Only the independent CPA firm issues the report, and no readiness engagement changes that.

Under the AICPA Code's general requirements for nonattest services, you must agree in writing to assume all management responsibilities, designate a named individual with suitable skill, knowledge or experience to oversee the work, evaluate the adequacy and results of the services and accept responsibility for those results. Before the firm starts, it must document its understanding with you covering the objectives, the services, your acceptance of your responsibilities, its own responsibilities and any limits. Ask the firm for that letter and confirm that your designated owner can explain the controls without the firm's help. Also ask which specific services it proposes, since the Journal of Accountancy cites information systems design, implementation or integration as a service whose effect on independence the CPA must evaluate.

Tool providers add a second line of review. If a provider is a responsible party under the SSAEs, the service auditor must be independent of both the provider and your organization, and whether that applies depends on the provider's services and the examination's scope. AICPA ethics staff have flagged cross-referral arrangements and referral fees, joint marketing terms, bundled pricing that sets the examination fee, provider rights to observe the work or set deadlines, and payments to a provider for access to examination evidence. Before signing, ask the firm to state in writing whether it has any such arrangement with the tool or readiness vendor you plan to use. An arrangement that the firm cannot explain is a reason to hire the readiness partner and the auditor separately.

What the AICPA Code requires before a CPA firm does readiness work

When a CPA firm also helps you get ready for a SOC 2, the AICPA Code sets conditions that protect the examination's independence. The four cards below cover the client's obligations, the written understanding the firm must sign, and the independence review that applies to systems work.

Management keeps all responsibilities

Under the AICPA Code's general requirements for nonattest services, the attest client must agree to assume all management responsibilities for the work. Readiness support cannot make the firm the decision-maker on controls, risk acceptance, policies or system design. Check the engagement letter for a clear statement that your leadership makes those choices, and ask who will sign off on each control you adopt.

A skilled individual oversees the work

The client must designate an individual with suitable skill, knowledge or experience to oversee the nonattest service. This person should understand the criteria well enough to challenge the firm's output, not simply forward documents. Ask who on your side holds this role, how much time they can commit, and whether they can explain each control to an assessor without the consultant in the room.

Client evaluates and accepts the results

The client must evaluate the adequacy and results of the nonattest services and accept responsibility for them. For readiness work, that means your team tests whether the controls actually operate, reviews the gap findings, and decides what to fix before the examination starts. A firm that hands over a finished control set with no review step by your staff creates a documentation gap that an assessor will notice.

Written understanding before work starts

Before performing nonattest services for an attest client, the CPA must document in writing its understanding with the client. The document should cover the engagement objectives, the services to be performed, the client's acceptance of its responsibilities, the CPA's responsibilities and any limitations. Request this letter before any readiness work begins, and check that limits on what the firm will and will not build are written into it.

Systems design and integration need review

The Journal of Accountancy lists information systems design, implementation or integration as a nonattest service whose effect on independence the CPA must evaluate. If the firm configures your logging, access tooling or deployment pipeline, it must assess whether that work threatens its objectivity in the examination. Ask the firm in writing whether it has completed this evaluation for your specific systems work before you agree on scope.

Who does what when the auditor also prepares you

The organization that undergoes the SOC 2 owns its controls, its system description and its final judgments. Management prepares the description of the system against the AICPA's 2018 description criteria, makes the written assertion, and signs the management representation letter that the service auditor requires under AT-C section 205. No outside party can take those responsibilities over, and the AICPA Code requires an attest client to accept them when it buys nonattest services.

Controls and policies: Management decides which controls operate, who owns them and whether they are appropriate for the criteria in scope.
System description: Management writes and approves the description, including boundaries, subservice organizations and complementary user entity controls.
Representation letter: Management signs the representations the auditor relies on, so its accuracy stays with the organization.
Designated oversight: The Code expects the client to name an individual with suitable skill, knowledge or experience to oversee any readiness service and to evaluate its results.
Accepting results: Management, not the consultant or the auditor, accepts responsibility for whether the controls work.

Before you sign any engagement letter, confirm in writing which of these tasks your own staff will perform.

Which arrangements threaten independence in a SOC 2 engagement

A SOC 2 examination is an SSAE attestation engagement, and the service auditor applies the AICPA Code of Professional Conduct in full, with limited modifications to the Independence Rule set out in ET 1.297 for SSAE work. That means independence is judged on the whole relationship, not only on the audit fee. Before you sign with a CPA firm, ask in writing whether the firm, or any affiliate, has a referral, marketing, pricing or technology arrangement with the tool provider or implementation partner you plan to use. The answer determines whether the firm can attest to your controls at all.

The first question is whether the tool provider is itself a responsible party under the SSAEs. If it is, the service auditor must be independent of both the provider and the service organization. Whether that applies depends on what the provider does (for example, whether it produces evidence or generates the system description) and on the scope of the examination. Confirm this with the firm before you buy the tool, and ask the firm to document its conclusion in its engagement file so your team can see it. A tool chosen first and checked later can force a change of auditor mid-cycle.

In April 2026, AICPA Ethics Staff Insights warned that business arrangements between CPA firms and SOC 2 tool providers can create significant threats to compliance with the AICPA Code. The warning named specific features to review: cross-referral arrangements and referral fees, joint marketing terms, bundled pricing that sets the examination fee, provider rights to observe the work or set deadlines, and payments to the provider for access to examination evidence. Treat any of these in a proposal as a question to resolve before signing. For background on the staff's concerns, read the Journal of Accountancy analysis of SOC engagements and tool provider risks.

Referral, bundling and access terms that raise ethics flags

AICPA ethics staff have flagged a set of commercial arrangements between CPA firms and SOC 2 tool or consulting providers as threats to independence. Each card below names one arrangement, the concern it raises, and what to ask the CPA firm to confirm in writing before the examination starts.

Cross-referral and referral fees

A CPA firm that sends you to a readiness provider, and receives a fee or favor for doing so, may be tempted to shape the examination around that provider's tooling or scope. Ask whether the firm pays or receives any referral compensation, whether it will name the provider in writing, and whether it will disclose every arrangement that touches your engagement. If the answer is no, the firm should say so plainly in the engagement letter.

Joint marketing terms

Co-branded webinars, shared landing pages and joint sales decks make the CPA firm look like part of the provider's sales team. That blurs who the examiner works for and can make the attest client feel obligated to buy the provider's services to keep the audit on schedule. Ask whether any marketing material names both firms, who approved it, and whether the CPA firm receives payment tied to the provider's sales.

Bundled pricing that sets the examination fee

A package that combines readiness, tooling and the examination under one price can hide what the audit itself costs and make the fee depend on buying the tooling. Ask the firm to quote the examination separately from any readiness or tool work, to confirm that the examination fee does not change if you switch or decline a tool, and to explain how the fee is set for the examination period.

Provider rights to observe or set deadlines

If a tool provider can watch the auditor's fieldwork, sit in on meetings or set the examination timetable, the provider has influence over the attestation. Ask the CPA firm to confirm that the provider has no observation rights, that the examination schedule is set only by the firm and the client, and that the provider cannot approve or reject findings.

Paying the provider for evidence access

Evidence an auditor samples should reach the auditor directly from your systems. When a provider charges to hold, release or transfer that evidence, the examiner's access depends on a commercial relationship with a party that may be a responsible party under the SSAEs. Ask whether the auditor can receive evidence without paying any intermediary, and whether the provider is independent of the auditor under the rules that apply to the examination.

How to check the arrangement before the readiness work starts

This sequence confirms that the CPA firm may perform readiness work for your engagement, documents who is responsible for what, and records an independence conclusion before any fieldwork begins. It produces three outputs: a written nonattest understanding, a named internal owner, and a written independence assessment.

Confirm the firm's nonattest services list
Ask the CPA firm in writing which nonattest services it offers to attest clients and whether readiness assessment, control design or control implementation falls within that list for your engagement. Ask who in the firm reviewed the request and who will be the independence contact. The step is complete when the firm has confirmed in writing which readiness tasks it may perform and which it will not, so you know where the line sits before any scope is agreed.
Assign an internal owner for the work
Name an individual in your organization with suitable skill, knowledge or experience to oversee any nonattest work, such as a security lead or compliance manager who can challenge the output. This person is not a contractor on the firm's side. Under the AICPA Code's requirements for nonattest services, the attest client must designate this individual, who evaluates the adequacy and results of the services. The step is complete when the owner's name and role are recorded in the engagement file and the owner has accepted the role in writing.
Agree that management retains responsibilities
Confirm that your organization accepts all management responsibilities for the readiness work, including decisions about controls, policies, system descriptions and the content of any management assertion. The firm may advise or perform tasks, but it cannot make these decisions on your behalf. Management also accepts responsibility for the results. The step is complete when management has signed an acceptance of these responsibilities, and the wording matches the nonattest understanding that follows.
Document the nonattest understanding in writing
Request the written understanding that the CPA firm must document with the client before it performs nonattest services for an attest client. It should cover the engagement objectives, the specific services, your acceptance of your responsibilities, the firm's responsibilities and any limitations. Check that each readiness task on the list in step one appears in the document. The step is complete when both parties have signed the understanding and it is stored with the engagement records.
Review referral and tool arrangements
Ask whether the firm has referral, joint marketing, bundled pricing or revenue-sharing arrangements with any consultant, software provider or platform that will be involved in your readiness work. Request copies of any such terms and check for referral fees, bundled pricing that sets the examination fee, provider rights to observe the work or set deadlines, and any payment to a provider for access to examination evidence. The step is complete when you have a written list of every arrangement and its fee and access terms, and you know which of them the firm has disclosed.
Obtain the written independence assessment
Ask the firm to document its independence conclusion for this engagement before fieldwork starts. The assessment should address the nonattest services being performed, any tool or provider arrangements, and whether the provider is a responsible party under the SSAEs, which would require the service auditor to be independent of that provider as well. Ask the firm to confirm how it evaluated each threat. The step is complete when the assessment is in writing, dated, and signed by the firm, and you have confirmed that its scope matches the understanding in step four.
Confirm the conclusion before fieldwork
Before the examination team begins fieldwork, reconcile the three documents: the nonattest understanding, the named owner and management's acceptance of responsibilities, and the independence assessment. Check that they describe the same services and the same people. If the readiness scope changes later, repeat the review before any further work is done. The step is complete when your internal owner confirms in writing that the three outputs are consistent and on file.

Mistakes that compromise the examination or the report

Most of these mistakes share one root: the firm that issues the opinion ends up doing work it must later test, or the organization stops understanding its own controls. Each card names a pattern, the damage it does to the report's credibility, and the check to run before signing.

Auditor designs, then tests

When the CPA firm writes the policies and builds the controls, it then has to evaluate whether those same controls work. Under the AICPA Code's nonattest rules, a firm that implements systems or controls must evaluate the effect on its independence, and the testing function loses its separation. Ask who designed each control and who tests it, and require a separate evaluation of design by someone other than the examining team.

No internal control owner

The Code requires an attest client to designate an individual with suitable skill, knowledge or experience to oversee nonattest services and to accept responsibility for their results. If no one on your staff can explain how an access review, change approval or log alert works, auditors will question management's assertion and the description of the system. Name an owner before the readiness work starts and make that person sign off on each control.

Bundled fees tied to tools

Bundled packages can link the examination fee to purchases of a tool or a provider's services, which AICPA ethics staff have flagged as a threat to independence. The report can then look like a sales outcome rather than an examination. Before signing, separate the audit fee from any software subscription, ask in writing whether the fee changes if you buy or do not buy a tool, and confirm the firm has no referral fee from the provider.

Vendor access to evidence

Giving a tool provider or readiness partner the right to observe fieldwork, set audit deadlines, or access examination evidence in exchange for payment undermines the auditor's control of the engagement. If the provider is a responsible party under the SSAEs, the service auditor must also be independent of that provider. Restrict vendor access to your own systems, keep auditor evidence requests and deliveries between you and the firm, and confirm this in the engagement letter.

Undocumented readiness scope

Before a CPA firm performs nonattest services for an attest client, the understanding must be documented in writing, covering objectives, services, the client's accepted responsibilities, the firm's responsibilities and any limitations. Informal help with policies, gap lists or control design leaves no record of who did what. When the report is questioned later, the absence of that record weakens management's position. Ask for a written scope that lists every readiness task and its owner.

Questions buyers ask about auditor readiness work

Can the CPA firm that issues my SOC 2 also build my controls?

Sometimes, but the firm must first confirm that the work is permitted under the AICPA Code and that its independence is not impaired. Preparing controls, writing policies or designing systems can fall under nonattest services, and the Code requires the firm to evaluate whether that work affects independence before it accepts the engagement. Information systems design, implementation or integration is one example the Journal of Accountancy lists as needing that evaluation. Ask the firm for its written independence analysis before you sign, not after the readiness work starts.

Does using the same firm for readiness and the audit save money, and what are the limits?

It can reduce duplicate onboarding and handoffs, but the saving is rarely the main driver of cost. Fees depend on system scope, the number of controls, the observation period for a Type 2 report and how much evidence your team already produces. Bundled pricing that ties the examination fee to other services is one arrangement AICPA ethics staff flagged as a concern. Ask whether the examination fee is set independently of any readiness or tool purchase, and whether you can compare the audit quote with a separate readiness quote.

What must our internal staff own if the firm helps with readiness?

Management keeps the responsibility. Under the AICPA Code's general requirements for nonattest services, the attest client must agree to assume all management responsibilities, designate an individual with suitable skill, knowledge or experience to oversee the service, evaluate the adequacy and results, and accept responsibility for those results. In practice that means a named owner who approves policies, reviews access decisions, signs off on risk assessments and can explain each control. If nobody inside the company can do that, the readiness work will not transfer into a report you can defend.

Do we need a separate readiness partner if our auditor cannot help?

Not always, but you need someone independent of the auditor to prepare systems and evidence if the auditor cannot. Many organizations use an implementation partner for control design, tooling and evidence collection, while the CPA firm only examines the result. DeployOpen prepares systems, controls and evidence for compliance assessments inside your own infrastructure, but it does not issue audit reports or attestations. Only an independent auditor can do that. Define the division of work in writing so that each party knows what it delivers.

What should we request in writing before we start readiness work with a CPA firm?

Ask for a written understanding of the engagement that covers its objectives, the specific services, your acceptance of management responsibilities, the firm's responsibilities and any limitations. The Code requires a CPA to document this before performing nonattest services for an attest client, so a firm that resists putting it in writing is a warning sign. Also request the independence analysis, the named oversight contact on your side, the list of deliverables, and confirmation that the examination fee and timing are not linked to any tool or referral arrangement.

Can an independence problem be fixed in the middle of an engagement?

It may be possible to correct it, but the firm has to identify the threat first and decide whether safeguards are enough or whether the readiness work must stop. Common triggers include a referral fee, a joint marketing term, a tool provider that observes the work or sets deadlines, or a payment for access to examination evidence. If the threat is significant, the firm may need to decline the examination or change the engagement structure, which can delay your report. Build a clause into your contract requiring the firm to tell you promptly if its independence position changes.

How do tool provider arrangements affect whether our auditor is independent?

They can create a threat if the provider is a responsible party under the SSAEs, because the service auditor must then be independent of both the provider and your organization. Whether that applies depends on what the provider does and the scope of the examination. AICPA Ethics Staff Insights from April 2026 warn that business arrangements between CPA firms and SOC 2 tool providers can raise significant threats to compliance with the Code. Ask your auditor whether any tool vendor it recommends has a referral, revenue or evidence-access arrangement with the firm.

How DeployOpen prepares systems and evidence without issuing the report

DeployOpen prepares the systems, controls and evidence that a SOC 2 examination will test, and the organization keeps ownership of its controls throughout. The CPA firm that issues the report stays a separate party, so the work DeployOpen does never replaces the independent examination.

How we scope

Scope is agreed in writing before work starts, so the boundary between preparation and the auditor's attestation is recorded from the outset.
The written scope names which systems, cloud accounts and Trust Services Criteria categories are covered by the readiness work.
Ask the CPA firm first which readiness activities it will accept, then confirm they match the scope DeployOpen signs.

How we build

Implementation partners prepare self-hosted open-source platforms and controls inside your own cloud accounts, data centers or air-gapped networks.
Control design is documented so management can explain each control, its owner and the evidence it produces.
Testing covers applications, APIs and infrastructure, with findings tracked to remediation under the agreed scope.

How we hand over

Deliverables include the system documentation, control descriptions and evidence collection procedures that your team operates after handover.
Your organization accepts responsibility for the results and designates an owner who can oversee and evaluate the work.
Confirm with your CPA firm, in writing, which artifacts it will sample so the handover matches its evidence requests.

How we support

Fixed-scope engagements end with agreed deliverables, and any further work is quoted from a new written scope.
Ongoing support, upgrades and continuous testing are available as retainers for the period between examinations.
Ask your CPA firm and your DeployOpen contact to agree in writing who handles each follow-up request and each change to the system.

Can your SOC 2 auditor also do your readiness work