What a SOC 2 consultant does and what it costs

What does a SOC 2 consultant do, and what does the work cost?

A customer or contract now asks for a SOC 2 report, and the first question is who can help you get there. A consultant or implementation partner prepares your systems, controls and evidence so that they are ready for examination. Only an independent CPA firm can examine them and issue the report. Keeping those two roles apart from the start protects the value of the report you eventually hand to customers, and it protects your schedule, because the firm that attests cannot also be the party that designed what it tests.

Consultant fees are one component of total cost, not the whole of it. The U.S. Justice Department's proposed rule published at 89 FR 86116 cited estimates that include readiness assessment, audit, remediation and consultant fees together. For a Type 1 report those estimates ran from $15,000 to $50,000 for small and medium businesses and from $50,000 to $100,000 for large ones. For a Type 2 report they ran from $30,000 to $75,000 and from $75,000 to $150,000 respectively. Those figures are a rough orientation, not a quote. Company size, the number of systems in scope, the number of additional categories selected, and how much remediation your environment already needs all move the number, and the CPA firm's fee rests on its own professional judgment.

The organization owns its controls. A consultant can write policies, configure tooling and collect evidence, but management must approve the policies, operate the controls every day and accept responsibility for the results. When requesting a quote, ask for a written split of deliverables, the named people who will do the work, which costs recur each year (such as tooling and the Type 2 observation period) and which are one-time remediation items. Confirm with your CPA firm, before engaging anyone, how it expects that work to be divided.

Who gets paid for what in a SOC 2 engagement

This table compares the parties that invoice for SOC 2 work, what each one is paid for, and whether the cost is one-time or recurring. Read it to see which fees are for preparing controls and which are for the examination itself. The main takeaway is that the CPA firm sets its own examination fee, and the consultant and tool costs sit outside it.

Payee	What they are paid for	One-time or recurring	What drives the cost
CPA firm (service auditor)	Performing the examination, testing controls, issuing the report or opinion	Recurring for Type 2 and each annual cycle	Scope, number of criteria, sampling, system complexity; the firm sets the fee on its own judgment
Readiness consultant	Gap assessment, control design advice, policy drafting, evidence walkthroughs before the audit	Usually one-time for the first report, then periodic	Number of gaps, system size, how much work the client's own staff will do
Implementation partner	Building or configuring controls and tooling, collecting evidence, documenting systems inside the client's environment	One-time build, then optional retainer for upkeep	Scope of systems, degree of existing automation, fixed-scope agreement terms
SOC tool provider	Software or service that helps design, operate and monitor controls and supports reporting	Usually recurring subscription	Number of users and integrations; check whether the tool fee is bundled with audit fees
Fractional or virtual CISO	Owning security leadership, oversight and accountability for the program	Recurring, usually on a time commitment	Hours committed, number of oversight meetings, board reporting duties
Your internal staff	Management responsibilities, control owners, reviewing evidence, approving changes	Ongoing internal time, not an invoice	Headcount available and skill level; management responsibility cannot be outsourced
Cloud and infrastructure providers	Hosting, logging and managed services used to run controls	Recurring usage fees	Services in use; provider SOC reports can support your own controls

Writing policies is not the same as building controls

A policy library tells an assessor what the organization intends to do. It does not show that anything happened. A SOC 2 Type 2 examination tests whether controls operated over the observation period, so the work that matters is configuring systems and running recurring activities that leave records behind. Drafting an access control policy is the start of the job. Building the controls means setting up the identity provider so that group membership maps to approved roles, enforcing multi-factor authentication for production access, sending access review results to a named reviewer, and keeping the approval and removal records each review produces. Logging works the same way: a policy that requires log retention means little unless the logs are collected centrally, alerts route to a person who acts on them, and the retention setting is visible in the configuration.

Change management and vendor oversight show the gap most clearly. A change policy might require peer review and testing before deployment, but the evidence an auditor samples is the pull request approval, the pipeline run, the ticket linking them and the deployment record for each sampled change. For vendors, the policy requires a risk assessment and review of each provider's SOC report, yet the auditor will look for the completed reviews, the dated exceptions and the follow-up decisions. Before engaging a consultant, ask which of these controls they will configure in your own systems, who will run them after handover, and which evidence source each one produces. Ask the consultant to show a sample of recurring evidence from a comparable environment, labeled as illustrative if it is not from a client.

Consultants can help draft policies and design controls, but the organization must own the decisions and operate the controls itself. Management remains responsible for the description of the system and for the controls it asserts, and the CPA firm tests what was in place and working during the period. A useful early check is a short dry run: pick a handful of controls, run them once in production, and see whether the resulting records would satisfy a reasonable sample request. Gaps found there are cheaper to close than gaps found during fieldwork, and they show the reader's team which activities must recur every month or quarter, which is where most ongoing effort goes.

What makes a SOC 2 consultant engagement cost more or less

A consultant's fee follows from how much work your team hands over and how many systems and controls the engagement must cover. The cards below separate the factors that move the total up or down, so you can compare written scopes rather than headline day rates.

Scope of trust services categories

Security covers the common criteria CC1 to CC9 and applies to every SOC 2. Adding availability, confidentiality, processing integrity or privacy adds criteria to test, evidence to collect and more control design work. Ask the consultant to list which categories the quote assumes and what each one adds to the hours.

Starting point of existing controls

A team with written policies, access reviews and logging already running needs a gap check and some remediation. A team starting from nothing needs design, policy writing and months of evidence generation before the observation period begins. Ask for a readiness assessment priced separately so you can see what the gap really costs to close.

Number and complexity of systems in scope

Every production system, cloud account, identity provider and third-party service that touches customer data widens the system description and the control matrix. Self-hosted platforms add infrastructure your team must configure and evidence. Ask the consultant to name each system in the quote and state which ones are excluded.

Who builds controls and who writes evidence

Writing policies is the smaller part of the work. Building controls means configuring access, logging, change approvals and backups in your environment, and then keeping the records that show they ran. Ask whether the fee covers technical implementation, evidence collection and monitoring, or only document drafts your staff must then put into practice.

One-time work versus recurring support

Readiness setup is a one-time project, but the Type 2 observation period, quarterly access reviews and annual policy updates recur. A low initial quote can hide a higher ongoing retainer. Ask which deliverables end at the report date and which continue, and what the monthly or annual cost is for each.

Independence and fee separation

The CPA firm sets its own examination fee on its professional judgment, and the consultant's fee is separate. A bundle that combines preparation and attestation under one price, or a referral arrangement, needs careful reading. Ask for separate written quotes and confirm that the consultant does not set or change the auditor's fee.

Where preparing ends and attesting begins

Management keeps responsibility for its controls and their results, a consultant prepares and advises, and the service auditor evaluates the controls and issues the report. Under the AICPA Code of Professional Conduct, a CPA firm that performs a SOC 2 examination must evaluate whether providing other services to the same client threatens its independence. Nonattest services such as information systems design, implementation or integration are a standard example of work that needs this evaluation. Before any readiness work starts, ask the CPA firm in writing which services it will provide, which it will decline, and how it will document its independence conclusion for each.

The Code's general requirements for nonattest services set out what the client must do. The client must agree to assume all management responsibilities, designate an individual with suitable skill, knowledge or experience to oversee the work, evaluate the adequacy and results of the services, and accept responsibility for those results. In practice, a named employee should own each control, approve every policy a consultant drafts, and be able to explain the system description without the consultant in the room. SOC 2 also rests on management's assertion and the written representations management gives the service auditor, which the auditor relies on under AT-C section 205. A consultant cannot sign those representations for you, and a tool provider cannot make them on your behalf.

No consultant or tool provider can promise a clean report, a fixed date for the opinion, or that your controls are effective. Only the independent service auditor forms that conclusion, based on its own testing of design and, for a Type 2 report, operating effectiveness over a period. The Journal of Accountancy noted in February 2026 that most new SOC tool providers are not CPA firms and therefore cannot attest to effectiveness. Treat any offer that guarantees compliance in weeks or hours as a warning sign, and confirm with your auditor which parts of the readiness work it will accept as evidence and which it will test independently.

Your team, the consultant and the CPA firm: who owns what

Management owns the system, its controls and the assertion that the auditor tests. No consultant or CPA firm can take that accountability over. Under the attestation standards, management must provide written representations to the service auditor, so the people who sign those representations must understand what they cover. Leadership also decides scope, the service commitments the system is built around and the risks the organization accepts.

Scope and commitments: Choose the trust services categories, the system boundary and the commitments made to customers.
Risk acceptance: Decide which risks are mitigated, transferred or accepted, and record that decision.
Representations: Sign the management assertion and representation letter after confirming each statement is true.
Resourcing: Fund the controls, tools and staff time the program needs for the observation period.
Named ownership: Designate an individual with suitable skill to oversee any outside help and to evaluate its results.

Before engaging anyone, confirm that a named executive can answer for each of these items without relying on the vendor.

How a consultant-supported SOC 2 moves from scoping to report

The sequence separates what management owns from what a consultant prepares and what the CPA firm independently tests, so each handoff ends with a written output. Read it as a checklist of decisions to make before you sign anything.

Define scope and trust services categories
Management decides which system, products, locations and third parties fall inside the examination, and which of the five trust services categories apply beyond the Security common criteria CC1 to CC9. The consultant helps document the boundary, but the choice belongs to the organization. The step closes with a written scope statement that the CPA firm reviews before fees are agreed, so both parties start from the same system boundary.
Assess readiness against the criteria
The consultant compares your current practices with the 2017 Trust Services Criteria and their points of focus, identifying gaps in governance, access, change management, monitoring and vendor oversight. This is a gap assessment, not an opinion on whether controls work. The output is a gap register with each gap tied to a criterion, an owner and a remediation proposal. Ask for the register to name the criteria each finding touches.
Write the system description with management
Management prepares the description of the system, which the consultant may draft from interviews and architecture records. The description follows the AICPA's 2018 description criteria, and management must accept responsibility for its accuracy. The step is complete when management signs off on a version that reflects how the system actually runs, including subservice organizations and complementary user entity controls.
Build or adjust controls and policies
Your engineers and control owners implement the changes identified in the gap register, such as access reviews, logging, change approvals and vendor reviews. The consultant can draft policies and procedures, but policies only count as evidence once staff follow them. Each control is recorded in a control matrix with its owner, frequency and the evidence it produces. The step closes when each in-scope criterion maps to at least one control with a named owner.
Collect and organize evidence
Control owners generate and retain the records the control matrix calls for, such as tickets, approvals, review sign-offs and system logs. The consultant checks that evidence is complete, dated and retrievable, and flags gaps before the auditor finds them. For a Type 2 report, this runs over the observation period rather than on a single date. The step is done when a sample of each control's evidence can be produced within a short, agreed timeframe.
Run a readiness review before the examination
Management and the consultant walk through the control matrix and evidence as an internal dry run, looking for gaps that would produce exceptions. Some firms offer this review, but where the same firm would also perform the examination, the arrangement must still satisfy the independence rules for nonattest services. The output is a list of residual risks that management has either fixed or accepted in writing.
Hand over to the CPA firm for the examination
The CPA firm performs the examination independently, reviews the system description, tests selected controls and requests evidence directly from your team. Management provides the written representations that the examination standard requires. Your consultant's role ends at preparation unless a separate, documented engagement covers support during fieldwork. The step closes when the firm issues its report, which is the only document that carries the SOC 2 opinion.
Confirm the report and plan the next cycle
Management reviews the issued report for exceptions and decides how to share it under its distribution terms, since a SOC 2 report is generally restricted use. The team records lessons from the examination and assigns owners for any remediation. Ask your consultant and CPA firm to confirm in writing which work continues into the next examination period. The step is finished when the next cycle has an owner, a scope and a control matrix update.

How to check a SOC 2 consultant before you sign

A consultant can help you prepare for a SOC 2 examination, but cannot make your controls effective or issue the report. The cards below cover the questions that separate a consultant who builds working controls from one who sells a package, and the terms to pin down before any money changes hands.

Confirm who owns the controls

Ask the consultant to show, in writing, which control decisions remain with your management. Under the AICPA Code's requirements for nonattest services, the attest client must assume all management responsibilities and accept responsibility for the results. A consultant who offers to own your policies, risk decisions or sign-offs is taking on work your organization must keep. Ask for a responsibility matrix that names an accountable person on your side for every control.

Check the scope of work

Request a written statement of which Trust Services Categories, systems, locations and subservice organizations the work covers. Confirm whether the deliverables are a gap assessment, a control design, evidence collection, or all three. A consultant who cannot name the in-scope systems before quoting is not yet reading your environment. Fixed scope, deliverables and timelines should be agreed in writing before work starts.

Separate policy writing from control building

Policy templates are the cheapest part of readiness and the least likely to pass an examination on their own. Ask how the consultant will change your infrastructure, access reviews, change records and monitoring so that each policy matches what your systems actually do. Ask for an example of a control that was implemented, tested and left with evidence, not only a document set.

Verify the independence line

If the same firm will also issue your report, the AICPA Code requires an independence evaluation for nonattest services such as information systems design or implementation. Ask the consultant whether it has a referral or revenue arrangement with any CPA firm, and whether it expects to be paid by that firm. Keep the preparer and the attest firm separate unless your attest firm has completed that evaluation in writing.

Read the fee and bundle terms

Ask who sets the examination fee. The AICPA's ethics staff stated in April 2026 that the fee rests on the service auditor's professional judgment, and that a tool provider setting or changing that fee in a bundle threatens compliance with the Code. Request separate quotes for readiness work, tooling, and the examination, and ask which lines recur after the first report.

Be wary of fast and easy promises

The Journal of Accountancy reported in February 2026 that some SOC tool vendors promise compliance in weeks or even hours. Compliance is not a term used in SOC 2 examinations, and most new tool providers are not CPA firms, so they cannot attest that controls are effective. Treat any promise of a fast, easy or cheap report as a reason to ask for the consultant's own track record and written limits on what it will deliver.

Questions buyers ask about SOC 2 consultants and cost

How much does a SOC 2 consultant cost?

A consultant's fee depends on how much readiness work you buy, not on a standard rate. Consultants and implementation partners are paid for readiness assessment, gap analysis, control design, policy drafting, evidence collection support and project management. The CPA firm that issues the report is paid separately for the examination itself. Ask every vendor for a fixed-scope quote that lists deliverables, the number of systems in scope and who performs each task. Published total estimates exist, and the Federal Register proposed rule on U.S. sensitive personal data (89 FR 86116) included readiness, audit, remediation and consultant fees in its ranges, so treat those figures as broad context rather than a quote for your organization.

Who sets the fee for the SOC 2 examination itself?

The CPA firm that performs the examination sets the fee, based on its own professional judgment. AICPA ethics staff wrote in April 2026 that a SOC tool provider setting or unilaterally changing that fee in a bundled package threatens compliance with the AICPA Code of Professional Conduct. Before signing, ask the audit firm for its fee basis in writing and confirm that no third party is adding a markup or controlling the price. Reviewing terms before signing is covered in the engagement letter guide.

Can a consultant write our SOC 2 policies for us?

A consultant can draft policies, but drafting is the easy part. A SOC 2 assessor tests whether controls operate as written, over time, with records that prove it. Policies that describe access reviews, change approvals or incident handling are only useful if your team performs those activities and keeps the evidence. Ask the consultant which controls it will build, which it will only document, and who on your team owns each one after the engagement ends.

What is the difference between a consultant and a SOC 2 auditor?

A consultant prepares your systems, controls and evidence, while an independent CPA firm performs the examination and issues the report. Only the CPA firm can attest that controls are designed suitably or operate effectively. A consultant cannot issue a SOC 2 report, certificate or badge, and any vendor that claims otherwise is making an invalid promise. Your organization remains responsible for its controls throughout.

Can the same firm consult on our readiness and issue our SOC 2 report?

Sometimes, but the AICPA Code limits what a CPA firm may do for an attest client. Nonattest services such as system design, implementation or integration require the client to take on management responsibilities, name a qualified overseer, evaluate the results and accept responsibility for them. The firm must also evaluate whether those services threaten independence. Ask the audit firm to document its independence assessment before it begins any readiness work for you.

How long does SOC 2 consultant work usually take?

Duration depends on the number of systems in scope, how mature your controls already are and how much of the work your team can absorb. Readiness work typically runs before the observation period begins, and a Type 2 report also needs a period of operating evidence. No standard duration is set by the AICPA for readiness. Ask each vendor for a dated plan with milestones and a list of what your staff must provide each week. Be cautious of anyone promising completion in weeks or hours, a warning the Journal of Accountancy raised in February 2026.

What should we check before hiring a SOC 2 implementation partner?

Check that the partner's scope is written, fixed and tied to named deliverables, and that it does not promise a SOC 2 result. Confirm who holds the administrator access, documentation and evidence after the project, and whether your team can run the controls without the partner. Ask whether the partner has any referral or revenue arrangement with the audit firm, since the AICPA ethics staff flagged such arrangements as an independence risk. Ask your own counsel to review the contract terms before signing.

How DeployOpen prepares systems and evidence for your SOC 2

DeployOpen works inside your own cloud accounts, data centers or private networks, preparing the systems, controls and records a SOC 2 examination will test. We do not write the report or decide whether controls are effective. An independent CPA firm does that, and we set up the work so that firm can test it.

How we scope

Engagements are fixed-scope, with the systems, Trust Services Criteria categories and deliverables agreed in writing before work starts.
The written scope states who owns each control, which tasks DeployOpen performs and which remain with your management team.
Scope also names the auditor you intend to use, so the readiness work matches what that CPA firm will test.

How we build

We map each in-scope criterion to a documented control, its owner, its operating frequency and the evidence it produces.
Controls are implemented on your platforms, including access management, logging, change tracking and backup configuration, using your own infrastructure.
Policies and procedures are drafted for your management to review, approve and adopt, so the decisions stay with your organization.

How we hand over

You receive the control matrix, system configuration documentation, runbooks and an evidence index that maps each record to its control.
Knowledge transfer sessions train named staff to run access reviews, evidence collection and monitoring without ongoing outside help.
Deliverables are stored in your repositories, so the evidence remains available to your team and to the auditor after the engagement ends.

How we support

Ongoing support, upgrades and continuous testing are available as retainers for organizations that want help between audit periods.
Support can cover running evidence collection for an observation period, answering auditor requests and updating controls after platform changes.
Any retainer is agreed in writing separately, so you can confirm the scope and frequency of support before the work begins.