SOC 2 auditor engagement letter: terms to check

What to check in a SOC 2 auditor engagement letter before signing

When a customer or contract requires a SOC 2, the budget owner needs to know what the CPA firm's engagement terms commit the organization to. The CPA firm that performs the examination sets the fee on its own professional judgment, and the terms must leave that auditor free to gather evidence, report required matters to you and decline work that would break the AICPA Code. Your organization owns its controls, an implementation partner prepares systems and evidence, and only the independent CPA firm issues the report. The engagement letter should reflect that split and nothing else.

Start with the fee. Ask who sets it, what it covers and what triggers a change. A fee set by a tool provider inside a bundled package is a warning sign, because AICPA ethics staff have said that a provider setting or unilaterally changing the examination fee threatens compliance with the Code (ET 1.230.030, determining fees). Check whether the letter bundles software, readiness work and the audit into one price, which items are priced separately, and whether any referral fee or joint marketing arrangement sits behind the quote. Ask the firm to confirm in writing that no part of the fee flows to a third party that also supplies your tools. The Journal of Accountancy's April 2026 article on tool provider risks lists the arrangements ethics staff flagged.

Then read what the letter restricts. Look for provider rights to observe the auditor's work, set deadlines for the examination, or require payment to access evidence, since ethics staff say paying a provider to reach examination evidence may raise questions about whether sufficient, appropriate evidence was obtained. Strike any non-disparagement clause or liability limit that would stop the auditor from communicating required matters to you. Confirm that the firm will not guarantee a clean opinion or a set pass rate, because the AICPA Code treats such promises as prohibited. If a term would stop the firm from complying with the Code, the firm is expected to decline or discontinue the engagement, so ask counsel to confirm how the letter handles that exit before you sign.

Who sets the SOC 2 examination fee and why it matters

The fee for a SOC 2 examination belongs to the CPA firm that performs it, and that single fact shapes how every other term in the engagement letter should read. The cards below set out why a fee set by anyone else creates independence and evidence risk, and the checks a buyer can apply to the fee clause before signing.

Fee rests on the auditor's judgment

Under the AICPA Code, the fee for a SOC 2 examination must rest on the service auditor's professional judgment (ET 1.230.030, determining fees). The fee should reflect the auditor's assessment of the work, the system and the risk, not a figure fixed in advance by a third party. When you read the engagement letter, look for the firm's own fee statement, signed by the firm, and check that it does not simply reference a price list from a tool vendor.

Tool provider cannot set the fee

AICPA ethics staff have said that a SOC tool provider setting or unilaterally changing the examination fee inside a bundled package threatens compliance with the AICPA Code. A bundle can be convenient, but the fee for the examination cannot be decided by the vendor that sells the tooling. Ask who negotiated the examination line item and whether the CPA firm can change it independently of the software subscription.

Fee line the firm signs

Ask for a fee line in the engagement letter that the CPA firm itself signs and issues, separate from any platform or tooling invoice. The letter should identify the examination fee, the period it covers and any items billed separately, such as readiness work or re-testing. If a tool provider appears as the party collecting the examination fee, treat that as a question to resolve before signing rather than a formality.

Scope that explains the fee

A fee should trace back to a written scope: which Trust Services Criteria categories are in scope, how many systems and locations the examination covers, whether it is a Type 1 or Type 2 report, and the observation period for a Type 2. Each of these drives effort and therefore price. Ask the firm to explain in writing what would cause the fee to change, such as adding a category, a new subservice organization or a longer period.

Fee not tied to outcomes

Check that the fee is not linked to a promised result. AICPA ethics staff list guaranteeing outcomes, such as a clean audit or a 100% pass rate, as prohibited. A fee that depends on passing, or a bonus payable on an unqualified opinion, signals that the examination may be shaped around the outcome rather than the evidence. Ask whether any part of the fee is contingent, and if so, on what.

Bundled tool and audit packages, referral fees and joint marketing

A bundle combines a SOC tool subscription with an examination from the same firm or from a firm the tool provider works with. The arrangement becomes a concern when the bundle sets the examination fee, or when the tool provider can change that fee on its own. AICPA ethics staff said the fee must rest on the service auditor's professional judgment, and that a tool provider setting or unilaterally changing the fee in a bundled package threatens compliance with the AICPA Code (ET 1.230.030, determining fees). The same reasoning applies to deadlines and observation rights. Ethics staff also flagged provider rights to observe the work or set deadlines, and terms that require the auditor to pay the provider to access evidence needed for the examination, which may raise questions about whether the auditor obtained sufficient, appropriate evidence.

Fee set by the provider: the examination fee appears as a line inside a tool subscription, and the provider can revise it.
Provider-set deadlines: the provider controls when fieldwork or the report must be finished.
Observation rights: the provider can watch auditor testing or sit in on meetings.
Paid evidence access: the auditor must pay the provider to reach systems or records that the examination needs.
Auditor selection by the tool: the tool chooses which CPA firm you use, without your own review.

Request a separate written fee from the CPA firm, a fee that does not change because of tool purchases, and written confirmation that the auditor, not the provider, decides on testing scope, sampling and deadlines.

Clauses that restrict evidence, observation or communication

These clauses look like ordinary commercial terms, but each one can limit what the CPA firm can see, when it can finish, or what it can tell you. Read them as conditions on the examination itself, because an auditor who cannot meet them may have to decline or stop the engagement.

Provider rights to observe the work

Some tool arrangements give the software provider a right to sit in on fieldwork, review auditor workpapers, or approve how testing is performed. The auditor must reach its own conclusions from its own professional judgment, so a provider with a say over the procedures puts that independence in question. Redline any clause that gives the provider observation or approval rights over testing, and confirm that all communication about the examination runs directly between you, the auditor and the evidence owners.

Provider deadlines on the examination

Terms that let a tool provider set or enforce deadlines for the auditor's work pressure the timing of the examination and can push the auditor to rush sampling or close fieldwork early. The engagement schedule should be set by the auditor and agreed with you, based on the observation period and evidence availability. Ask for the auditor's own timeline in writing and remove any provider-imposed milestones from the contract.

Paying the provider for evidence access

Some arrangements require the service auditor to pay a tool provider to access the evidence needed for the examination. AICPA ethics staff say this may raise questions about whether the auditor obtained sufficient, appropriate evidence, because access to evidence then depends on a payment. Your evidence should flow to the auditor at no charge through your own systems. Redline any fee for evidence access and confirm who bears the cost of exports and reports.

Non-disparagement clauses that gag the auditor

A non-disparagement clause can stop the CPA firm from telling you about matters it is required to communicate, such as control deficiencies, scope limitations or independence concerns. If the auditor cannot report these to you, you may learn about a problem only after the report is issued. Ask for language confirming that nothing in the agreement limits required communications to the client, and remove any restriction on what the auditor may say to you.

Liability limits that block required communication

Liability caps and waivers are often drafted broadly enough to prevent the auditor from disclosing matters it must raise, or to discourage it from raising them at all. A limit should allocate financial risk between the parties without changing what the auditor is allowed to tell you. Check whether the cap, indemnity or exclusion language refers to communications, and ask counsel to confirm that required disclosures sit outside it.

Tool bundles that change the auditor's obligations

When a tool provider and an audit firm sign a bundled package, the terms can quietly shift who controls evidence, timing or communication. Ask the auditor to confirm in writing that the examination terms are its own, not the provider's, and that you can decline the bundle without losing the audit. If the auditor says the arrangement would prevent compliance with the AICPA Code or the attestation standards, it should decline or discontinue the engagement.

How to review the engagement letter before a SOC 2 starts

This sequence turns a proposed engagement letter and any tool provider agreement into a documented decision, so you know who controls the fee, the evidence, the communication and the opinion before you commit.

Gather every proposed agreement
Collect the CPA firm's engagement letter, any statement of work, any tool provider or platform agreement the firm wants you to sign, and any referral, reseller or joint marketing terms. Confirm which document governs if they conflict. Output: a single folder listing each document, its version date and its signatories. You know this step is done when no clause you plan to rely on lives only in an email or a verbal promise.
Map every party's role
Write down who does what: the CPA firm issues the opinion, your organization owns its controls and management representations, any implementation partner prepares systems and evidence, and any tool provider supplies software. Mark where a party is paid by another party. Output: a one-page role map that shows the firm as the sole issuer of the report. You know this step is done when every deliverable has exactly one owner.
Mark fee and payment clauses
Find the examination fee, how it is set, when it can change and who receives payment. Flag any bundled package that prices the examination together with tool licenses, and any term that lets a tool provider set or change the fee. Ask the firm to explain in writing how its fee rests on its own professional judgment. Output: a fee clause summary with each open question. You know this step is done when the examination fee is shown separately from tool charges.
Mark deadline, observation and access clauses
Check whether the agreement lets anyone other than the firm set deadlines, observe fieldwork, or require payment to access examination evidence. Note any requirement to route evidence through a provider's platform. Output: a list of clauses that touch timing and evidence access, each with the question to put to the firm. You know this step is done when you can state who may see which evidence and on whose schedule.
Mark communication and liability clauses
Look for non-disparagement terms, liability limits or confidentiality language that could stop the auditor from communicating required matters to you, such as exceptions, deficiencies or scope limits. Check that the firm can report to management and, where applicable, to those charged with governance. Output: a list of communication restrictions, each marked for legal review. You know this step is done when no clause appears to limit the auditor's reporting duties.
Ask the firm to confirm ownership in writing
Send the firm a written request to confirm that it sets the examination fee, decides the scope of testing, owns the opinion and controls the evidence it relies on. Ask it to state whether it receives any referral fee or compensation linked to a tool provider. Output: a written reply from the firm. You know this step is done when the reply addresses each question and matches the signed letter. If the firm declines or the answers conflict with the letter, record that as a finding.
Complete legal and procurement review
Send the mapped clauses, the role map and the firm's written answers to your legal counsel and procurement team. Ask them to review liability, indemnity, data handling and termination rights, and to confirm that any tool agreement is separate from the examination fee. Output: a signed review memo with approved changes or an approved list of exceptions. You know this step is done when legal and procurement have each signed off on the same version.
Decide whether to sign or walk away
Choose one of two outcomes. Sign only when the letter keeps fee, opinion, evidence and communication with the firm, and any tool or partner terms sit in separate agreements. Decline or pause the engagement when a term would stop the firm from complying with the AICPA Code or the attestation standards, because ethics staff say the auditor should then decline or discontinue the engagement or the arrangement. Output: a dated decision record filed with the signed letter or the rejection notice. You know this step is done when the decision and its reasons are documented.

Promises an auditor is not allowed to make

Some promises are off limits for a CPA firm performing a SOC 2 examination, whether the promise comes from the firm itself or from a tool provider or consultant working alongside it. The cards below cover the guarantees, labels and marketing claims that should prompt you to question an engagement letter before you sign it.

Guaranteed clean audit outcomes

An auditor cannot guarantee a clean opinion or a 100% pass rate. The opinion depends on what the examination finds once fieldwork tests the controls, so a promise of a clean report is a promise about a result the auditor has not yet evaluated. Check the engagement letter and any proposal for words such as guaranteed, assured or certain, including in appendices from a bundled tool package. If a provider offers a pass guarantee, ask who would be liable if exceptions appear and whether the firm agreed to that term.

Describing the auditor as AICPA-approved

Calling a CPA firm or its staff AICPA-approved, or implying endorsement by the AICPA, is listed among the prohibited examples of misleading claims. Terms in marketing material, sales decks or a provider's website can create that impression even when the engagement letter is silent. Ask the firm to confirm in writing how it describes its SOC work and to show you the credential or license it actually holds, and confirm the firm's licensing with your state board of accountancy.

Misleading advertising and third-party promotion

The AICPA Code bars false or misleading advertising, and auditors are responsible for promotion of their services by third parties. A tool provider that markets a fixed-price SOC 2 with a named auditor, or a consultant that quotes an auditor's name in its advertising, may be making claims the auditor has not approved. Ask whether the firm has reviewed any co-branded material, and whether it accepts responsibility for what partners say about its services.

Arrangements that block Code compliance

When a business arrangement would prevent the auditor from complying with the AICPA Code or the attestation standards, the auditor should decline or discontinue the engagement or the arrangement. For a buyer, this means an engagement can be interrupted midway if the underlying terms conflict with independence. Ask the firm how it handles that situation, and ask what happens to your timeline and evidence if the engagement must stop.

Promises that the report will be fast

Promises of a fast or easy SOC 2 can conflict with the work the examination requires, including management's written representations and sufficient evidence over the period tested. A firm or provider that commits to a report date before scoping the system and reviewing controls is making a promise about process it does not control. Ask for a written timeline that depends on your readiness and evidence, and treat any date fixed in advance by a tool vendor as a sales claim rather than an audit commitment.

Questions buyers ask about SOC 2 engagement letters

Can a SOC tool provider set the audit fee in a bundle?

No. The fee for a SOC 2 examination must rest on the service auditor's own professional judgment, so a tool provider that sets or unilaterally changes the examination fee inside a bundled package creates a problem under the AICPA Code (ET 1.230.030, determining fees). AICPA ethics staff made this point in April 2026. Check the letter for any clause that gives a vendor a say in pricing the examination, changing it, or tying it to the tool subscription. Ask the firm to confirm in writing that its fee is set by the firm alone, and ask whether the tool provider receives any payment linked to that fee. If the answer is unclear, treat it as a reason to pause and ask again before signing.

Can we negotiate the terms of a SOC 2 engagement letter?

Yes, within limits. Scope, timing, deliverables, and your own responsibilities are normal subjects for negotiation, and a firm should be able to explain why each term exists. The terms the firm is not free to change are those that would weaken its independence or its ability to gather sufficient, appropriate evidence. If the firm says a clause must stay because of the AICPA Code, ask which rule it relies on. Where a business arrangement would prevent compliance with the AICPA Code or the attestation standards, AICPA ethics staff say the service auditor should decline or discontinue the engagement or the arrangement. Expect that some firms will resist edits to standard language, and weigh that resistance as information about how they treat independence.

What must an engagement letter let the auditor tell us?

The letter must not stop the auditor from communicating matters that the attestation standards require it to report to you. AICPA ethics staff list non-disparagement clauses and liability limits that prevent the auditor from communicating required matters to the client among the problematic terms in tool provider arrangements. Look for clauses that restrict the auditor from discussing control deficiencies, exceptions, or scope limitations with you, and for any requirement that the auditor clear its findings with a vendor before sharing them. Ask the firm to confirm, in writing, that it can communicate all required matters to management and the governing body without prior approval from any third party.

Is every bundled SOC 2 package a problem?

No. A bundle is not automatically improper, but its structure decides whether it is. Software and services can be sold together when the tool is a separate product, the examination fee is set independently by the firm, and no referral fee or joint marketing arrangement ties the two together. The concerns AICPA ethics staff raised in April 2026 include cross-referral arrangements, referral fees, joint marketing terms, and bundled pricing that sets the examination fee. Ask for each component to be priced separately, ask whether the provider earns anything when you buy the audit, and ask whether the firm has a financial interest in the tool. A clean separation on paper is the minimum you should expect.

What must our team provide during SOC 2 fieldwork?

Your team must provide the evidence, system descriptions, and management representations the auditor requests, and the engagement letter should say so in concrete terms. The auditor requests written representations from management under AT-C section 205, and the illustrative Type 2 letter from the AICPA shows the type of statements management signs. Check that the letter does not promise the firm access to your systems on terms that conflict with your security policy, and that it does not let a third party decide what evidence the auditor may see. Confirm the expected response times, the sampling approach, and who is the named contact. Also confirm that the firm will not require you to pay a tool provider to access evidence needed for the examination, since AICPA ethics staff say such terms may raise questions about obtaining sufficient, appropriate evidence.

Can an implementation partner review our SOC 2 engagement letter?

Yes. An implementation partner can review the letter for operational fit, such as whether the deliverables match what your team and systems can produce, and whether the timing and evidence requests are workable. That review does not replace legal counsel or the auditor's own judgment, and the partner cannot change the firm's terms or sign on its behalf. The organization owns the decision and the contract. Ask any partner to confirm in writing that it has no referral, fee sharing, or marketing arrangement with the CPA firm. If a partner also recommends or sells a tool, check that arrangement against the same questions you would ask of the firm.

Are promises of a clean audit or fast results a warning sign?

Yes. The AICPA Code bars false or misleading advertising, and AICPA ethics staff list guaranteeing outcomes, such as a clean audit or a 100% pass rate, as prohibited. A letter or sales document that promises a particular opinion, speed, or result should be treated as a red flag. An auditor cannot know the outcome of an examination before the evidence is tested. Ask the firm to remove any outcome promise from the engagement terms, and ask whether it describes itself as AICPA-approved, which ethics staff also list as prohibited. The Journal of Accountancy has also warned that promises of fast and easy SOC reports threaten their credibility.

What to ask the CPA firm to confirm in writing

Before signing, ask the CPA firm to confirm in writing that it sets the examination fee itself, based on its own professional judgment. The AICPA's ethics staff have said that a tool provider setting or unilaterally changing the fee inside a bundled package threatens compliance with the AICPA Code, so a single bundled price that names the audit fee is a term to question, not accept. Also confirm that the firm's independence of opinion is not conditioned on any tool, referral or joint marketing arrangement, and ask whether the firm has any cross-referral, referral fee or joint marketing terms with the provider you are considering. If it does, the firm should be able to explain how it will manage those relationships and what it will disclose to you. Next, confirm the firm's access to evidence and its freedom to communicate. The engagement letter should make clear that the service auditor can obtain sufficient, appropriate evidence directly from your systems and personnel without paying a tool provider for access, and that the provider has no right to observe the examination, set deadlines for the auditor or control the timing of fieldwork. Check that no non-disparagement clause or liability limit prevents the firm from reporting required matters to you, such as control deficiencies or exceptions found during testing. Ask the firm to state these points in its own words, because a clause that restricts communication is the kind the AICPA's ethics staff have flagged. Finally, understand the document you sign. The AICPA's illustrative management representation letter for a SOC 2 Type 2 examination is a letter your organization's management signs and addresses to the service auditor, confirming statements about the system, controls and known matters. It is not a term the auditor waives or a concession from the firm, and signing it does not transfer responsibility for controls to the auditor. Read it alongside the engagement letter, confirm that your people can support each representation before fieldwork begins, and ask the firm to confirm that it will not guarantee a clean opinion or a particular outcome, since the AICPA Code treats such guarantees as prohibited.

How DeployOpen prepares systems and evidence alongside your CPA firm

DeployOpen prepares the systems, controls and evidence that your CPA firm will test, but it does not issue SOC 2 reports or opinions. We work inside your own infrastructure so your organization keeps ownership of its controls, and we keep the separation between preparing evidence and the auditor's independent judgment clear from the first conversation about engagement terms.

How we scope

We review the engagement terms your CPA firm proposes and list which items affect systems, evidence and communication.
Scope is agreed in writing before work starts, with named deliverables for each term that touches your environment.
We confirm with you which decisions stay with management and which parts the auditor must perform independently.

How we build

We configure the systems that produce evidence for the auditor, including access records, logging and change history, in your own cloud accounts or data centers.
We document the control matrix and map each control to the evidence the auditor will request, so gaps appear before fieldwork.
We keep evidence collection independent of any bundled tool arrangement, so the firm can access records without paying a third party for them.

How we hand over

You receive configuration records, control documentation and an evidence index written so your team and the auditor can follow them.
We walk your staff through the runbooks so your team can keep producing evidence after the engagement closes.
Handover is documented against the written scope, so you can show which terms were reviewed and what was delivered.

How we support

Engagements are fixed-scope, and ongoing support, upgrades and continuous testing are available as a retainer.
Between audit periods we can help your team monitor controls and refresh evidence when your systems change.
When your auditor raises questions about the systems we prepared, we answer on the technical facts and leave the audit judgment to the firm.