Changing SOC 2 auditors: when and how to switch

When should you change SOC 2 auditors, and can you do it without a coverage gap?

Yes, a switch is workable if the new firm holds a valid CPA license and is enrolled in the AICPA Peer Review Program, and if the handover is timed to the end of the current report period so that no stretch of time goes unreported. Whether it is wise depends on three things: the conduct of the firm you have, the scope of the report your customers rely on, and where your current observation period sits. Your organization owns its controls. An implementation partner such as DeployOpen can prepare systems and evidence for the new examination, but only the independent CPA firm you engage issues the report.

Start by checking the current firm before you decide anything. Look at how the report was built: whether the system description reflects your real environment, whether the testing was tailored to your risks, and whether the report reads like a template with your logo added. Confirm the firm's license status on CPAverify, a free search hosted by NASBA, and check its enrollment and latest peer review results in the AICPA Peer Review Public File. Make sure you know which trust services categories and criteria the current report covers, since a new firm will need the same scope to avoid a gap in what customers can see.

Plan the timing against the period, not the calendar. A switch that lands mid-period forces the new firm to test controls it did not observe from the start, so most teams aim for a handover at a period boundary. Before you sign, ask the candidate how it will handle sampling, what it needs from you in the first weeks, whether it will issue a bridge letter if the report date and your customers' needs do not line up, and how it keeps its independence. Confirm the fee and timeline in writing from the firm itself, because the AICPA's ethics staff has stated that the fee must rest on the auditor's professional judgment.

What warning signs should prompt a review of your current SOC 2 firm?

Most problems with a SOC 2 firm show up in the sales pitch and in the report itself before they show up in a customer dispute. The cards below describe the signals the Journal of Accountancy flagged in February 2026, plus one the buyer must judge from the report. Document each concern with dates and specifics before raising it with the firm.

Compliance promised in weeks or hours

A firm or tool that promises a SOC 2 report in weeks or hours is describing a process that skips the observation period and the sampling a service auditor must perform. A Type 2 report needs controls tested over a period, so the timeline in the proposal should match the period your customers expect. Ask the firm to walk through the fieldwork steps and the dates it has committed to, in writing.

Referral marketing about report volume

Marketing that alludes to thousands of SOC 2 reports a year tells you about the firm's throughput, not about the depth of testing on your environment. High volume can mean limited time per engagement and templated work papers. Ask how many engagements each senior staff member leads, and who signs the opinion.

Identical reports apart from the logo

Reports that read the same across clients, with only the company name and logo changed, suggest the system description and control tests were not written for your systems. Your report should describe your services, subservice organizations, infrastructure and risks. Compare a sample report from the firm with one from another client in a similar sector and look for differences in the description and testing.

Reports that miss your own systems

A report that does not reflect your actual systems and risks is a concern even when the firm's name is well known. Check whether the control descriptions match your current cloud accounts, identity provider, change process and incident handling. Gaps between the report and your environment can later appear as exceptions your customers and their assessors will question.

Referral platforms promising outcomes

Referral platforms that promise clients favorable outcomes, such as a clean opinion or a particular fee, put commercial pressure on the examination. The AICPA's ethics staff wrote in April 2026 that fees must rest on the service auditor's professional judgment, so a platform that sets or changes the fee in a bundle is a warning sign. Ask who the firm's client is and whether the platform receives any payment tied to the result.

How do you verify a new SOC 2 firm's license and peer review?

This sequence confirms that the CPA firm is licensed, enrolled and peer reviewed before you sign, so the report you receive will carry weight with customers and auditors. Each check produces a record you can keep in your vendor file.

Collect the firm's legal name and engagement partner
Ask the firm for its exact registered name, the state or states where it is licensed, and the name of the partner who would sign the report. Compare these details against the proposal and engagement letter. The output is a short verification record listing the firm name, partner name and jurisdictions, which you will use in every later check. Firms that cannot give these details plainly should move to the top of your concern list.
Search the firm in CPAverify
Run the firm and the partner through CPAverify, the free license search hosted by NASBA. It draws on official data from 53 participating jurisdictions and shows license status and any state board disciplinary actions. Your team, or the firm's compliance contact, can run the search. The check is complete when you have saved the results with the search date, showing an active license for the signing partner and no open disciplinary action that you have not discussed with the firm.
Confirm enrollment in the AICPA Peer Review Program
Open the AICPA Peer Review Public File and search for the firm. The file shows whether the firm is enrolled and its enrollment status. An enrolled firm must have a peer review once every three years. A firm that is not listed or not enrolled is a serious concern for a SOC 2 engagement, and the AICPA states that it acts against members who were not enrolled in peer review or were unlicensed. The check is complete when you have recorded the enrollment status and the review cycle the firm reports.
Review the latest peer review and its rating
Look for the most recent accepted peer review document. The public file shows accepted documents for firms in PCPS, EBPAQC or GAQC, or for firms that choose to make them public. Check the rating, which is pass, pass with deficiencies or fail. Confirm whether SOC 1 and SOC 2 examinations were must-select engagements in the system review when applicable, and whether the reviewer selected any SOC 2 engagements. The output is a note on the rating and the date, and any deficiencies the firm has described as corrected.
Request the report when the public file is silent
If the public file does not show the firm's accepted peer review, ask the firm to provide its most recent peer review report and letter of response in writing. A firm that is enrolled but chooses not to publish may still provide these documents. Verify the report covers the firm and the practice unit that will sign your SOC 2, and that the date falls within the three-year cycle. The check is complete when the document is on file and you have confirmed its scope matches the signing office.
Ask how the firm responds to peer review findings on SOC 2 work
Ask whether any findings in the review related to SOC 2 engagements, and what the firm changed as a result. Peer reviewers now look at whether SOC 2 engagements are tailored to each client's risks and environment, and follow-up for nonconforming work can include an outside party reviewing completed engagements. A credible answer names the change in methodology, training or quality review and describes how it applies to your engagement. Record the answer in your file with the date.
Decide and document the verification result
Bring the license record, public file entry, peer review rating and any response together in one summary for your security and procurement leads. Mark each check as passed, passed with questions, or failed. Only proceed when the signing partner is licensed, the firm is enrolled and its latest review is accepted with a rating you can explain. Keep the summary with the engagement letter so that a customer or auditor can see the basis for your choice later.

How do you time an auditor change against your report period?

The safest time to switch CPA firms is at a period boundary, with the new firm engaged before the current observation period closes. A service auditor generally needs the controls and evidence for the period it will examine, so a firm that starts mid-period inherits operating history it did not test and may have to rely on evidence it cannot verify. Your current firm will usually issue its report for the last period you completed, and the new firm should begin planning its examination before that period ends so the handover does not leave a window where no examiner has looked at the controls.

Treat the gap between the end of the last report and the first report from the new firm as the main risk to plan around. A bridge letter is a management-signed statement that covers the period between the report's end date and a later date, confirming whether controls changed and whether management knows of anything that would affect the system description. Bridge letters are not issued by the auditor as an audit report, and customers and their assessors decide whether they accept them. Ask each customer whether they require a bridge letter, how far it must reach, and whether they will accept one from a firm that is switching. Confirm the exact dates for the period end, the new firm's start and the bridge coverage with both firms and with the customers who receive the report.

Before signing with the new firm, confirm in writing when its fieldwork starts, which period it will examine, how it will handle any controls you changed during the switch, and whether it will need the prior firm's workpapers or report. Ask the outgoing firm for its engagement status and for any open items it has raised, since unresolved exceptions can affect how the new firm approaches the first period. Your engagement letter with each firm should state these dates so that neither firm assumes the other is covering the transition.

Who does what when the auditor changes?

Your organization owns the controls, the system description and the decision to change firms. The SOC 2 report describes your system and your controls, so the switch remains your call and your responsibility, even when outside parties do much of the preparation. You also hold the records that both firms need, and you decide how the transition is communicated to customers who rely on the current report.

Decision and timing: Decide whether to switch, and when, against the current report period so the new firm's engagement does not leave an uncovered window.
Records for both firms: Give the outgoing and incoming firms the same set of policies, system descriptions, population lists and evidence, so that differences between the two engagements come from the firms' judgment rather than from inconsistent inputs.
Engagement contracts: Sign the engagement letter with the new firm and confirm the exit terms with the old one, including the notice period and the handling of unfinished work.
Customer communication: Tell customers and prospects who have requested the report when the current report ends, when the next one is expected and who issues it.
Internal ownership: Name one owner for the transition who tracks open requests from both firms and keeps the control owners informed.

Before you move, confirm in writing which records you are entitled to share and which the outgoing firm will need to release to the new firm.

What should you ask a new SOC 2 firm before signing?

A new CPA firm will hold your SOC 2 report for at least one period, so the questions you ask before signing matter as much as the price. The cards below cover what to check about the firm itself, how the examination will run, and how the engagement letter should record scope and fees.

Firm size and capacity

Ask how many SOC 2 examinations the firm runs each year, how many staff work on them, and who will lead fieldwork on your engagement. A firm that takes on more clients than its team can staff often produces rushed testing late in the period. Ask for the partner's name and the names of the staff who will sample your evidence, then confirm how much of their time is committed to your examination window.

References from similar systems

Ask for references from clients with a comparable architecture, such as a SaaS product hosted on cloud infrastructure with a similar number of production systems. Speak with at least one client whose report went through a change in period or a control exception. Their experience with turnaround times and the quality of the auditor's questions will tell you more than a sales deck.

Staff qualifications and licenses

Confirm that the signing partner and the engagement team hold current CPA licenses. Look up each name and the firm itself in CPAverify, the free license search hosted by NASBA, which shows license status and flags state board disciplinary actions. Ask which members of the team have prior SOC 2 experience and what technical training they have in cloud and identity systems.

Peer review results

Ask for the firm's most recent peer review report and its rating, which is pass, pass with deficiencies or fail. Confirm the firm is enrolled in the AICPA Peer Review Program and check its enrollment status in the public file. Because SOC 2 examinations are must-select engagements in a system review when they apply, ask how the reviewer assessed the firm's SOC work specifically.

Examination scope and sampling

Ask how the firm defines the examination scope for your system, which trust services categories it expects, and how it will treat your subservice organizations. Ask how it selects samples for each control, how large the samples are, and how it handles a control that operated only for part of the period. Vague answers here often lead to surprises in fieldwork or a report that does not match what your customers asked for.

Independence and fee basis

Ask how the firm maintains independence from your company and from any tool provider you use, including whether it has done consulting work for you in the past. The fee must rest on the service auditor's professional judgment. A tool provider that sets the fee, or changes it on its own inside a bundled package, raises ethics concerns under the AICPA Code (ET 1.230.030, determining fees). Ask the firm to quote its fee directly, and confirm that the engagement letter, not a vendor package, is the document that sets it.

Nonconforming findings and engagement letter

Ask what the firm does when its own reviewers or a peer reviewer find nonconforming work, and whether an outside party may review completed engagements. Ask who performs fieldwork, whether any of it is subcontracted, and who signs the report. Then confirm the engagement letter states the scope, the deliverables, the timing and the fee in writing before work starts, and that it names who is responsible for management's representations.

Why should the fee and independence be settled before you commit?

The CPA firm that performs the examination sets the fee, and it should be the one that quotes it. The fee rests on the service auditor's professional judgment about the scope, the risks in your system and the work needed to test them. Ask each candidate firm for a written fee quote built from your written scope, and ask how the fee changes if the system description, the number of in-scope services or the observation period changes. Be cautious of a bundle in which a compliance platform or consultant presents an all-in price and the audit fee appears as a line item set by someone else. In April 2026, AICPA ethics staff wrote that a SOC tool provider setting or unilaterally changing the fee in a bundled package threatens compliance with the AICPA Code (ET 1.230.030, determining fees). A fee that a vendor controls is a question to raise with the firm before you sign anything.

Independence is the second check, and it is about roles. A firm that also designs, configures or sells the controls it is about to test has a conflict that must be disclosed and managed. Ask each candidate whether it or any affiliate has prepared your controls, written your policies, operated your tooling or recommended a vendor it would then examine. Ask who on the engagement team would be doing that work and how the firm keeps the examination separate from it. Your organization owns its controls, and an implementation partner can prepare systems and evidence, but only the independent firm issues the report. Confirm the answer in writing and file it with your engagement letter, because a customer's assessor may ask about it later.

Settle both points before the transition plan is final, because the new firm's quote and independence declaration determine whether the switch is practical. Confirm with the firm and its enrolled peer review how it handled independence on your predecessor's engagement, and whether it will rely on the prior firm's evidence or retest it. Your next read is the AICPA SOC 2 topic page, which sets out the examination framework that any firm you hire must follow.

What usually causes a failed or delayed auditor switch?

Most delayed auditor changes trace back to timing, credential checks, report quality and scope alignment. Each pitfall below can leave a service organization without a current report or with a report a customer cannot rely on, so each one needs a check before the new engagement is signed.

Starting after the period closes

A new firm usually cannot test a period that has already ended without a gap in coverage. If the current period closes before the successor is engaged and planned, the next Type 2 report may start late or leave a window customers can see. Map the end date of the current period to the successor's planning calendar and agree the start of the new period in writing before the current examination finishes. Confirm the period boundaries with both firms first.

Skipping the peer review check

Changing firms without checking the new firm's peer review result is a common oversight. Firms enrolled in the AICPA Peer Review Program must have a review once every three years, and SOC 2 examinations are must-select engagements in a system review when applicable. Ask for the most recent report rating, which is pass, pass with deficiencies or fail, and confirm enrollment status in the AICPA Peer Review Public File before signing.

Accepting a template report

Reports that look identical across clients, apart from the logo, suggest the examination was not tailored to the organization's risks and environment. Reviewers now look at whether engagements are tailored to each client, and nonconforming work can lead to an outside party reviewing completed engagements. Ask the new firm for a sample report with its testing approach, and check that the system description, control descriptions and testing matched your environment.

Mismatched scope and system description

A successor that scopes the examination differently from the existing system description can produce a report that no longer describes what customers use. Differences in boundary, subservice organizations, included categories or infrastructure can leave controls untested or described inaccurately. Reconcile the new firm's scope against the current system description line by line, including any changes made during the period, and document each difference that needs management's update before fieldwork begins.

Frequently asked questions about changing SOC 2 auditors

Can we keep the same report period when we switch SOC 2 auditors?

Often yes, but the period is set by your organization and agreed with the new firm, not handed over by the old one. The aim is back-to-back periods with no gap in coverage, so the last report period of the former firm ends where the first period of the new firm begins. Confirm with the incoming firm how it will treat the boundary, which systems and controls the period covers, and whether it will need to test anything from the period before its engagement. Ask for the engagement timing in writing before you give notice to the current firm.

Does a new SOC 2 firm have to re-test controls that were already tested?

A new firm is not bound by the former firm's testing and will usually want its own evidence for the period it examines. It may review the prior report, the system description and the prior exceptions to understand the environment, and it can reasonably rely on evidence it can verify. Expect re-performance of some tests, particularly where the prior report recorded exceptions or where controls changed. Ask the new firm which prior-period work it will accept, how it will sample, and what it needs from your team to avoid duplicate requests.

Who owns the SOC 2 evidence when we change firms?

Your organization owns its evidence, policies, system description and control records. The CPA firm performs the examination and issues the report, and it keeps its own working papers under its professional obligations. Keep an internal copy of every artifact the former firm requested, including screenshots, exports, access review sign-offs and change tickets, in a location your team controls. This protects you if the handover is slow and makes it easier for the new firm to inherit a complete record.

How much effort does switching firms take the internal team?

The effort is driven mainly by how well evidence is organized, how many controls changed since the last period, and how many requests the new firm raises during planning. Teams with a current control matrix and an evidence index usually spend less time on onboarding than teams that rebuild records for each auditor. Plan time for kickoff meetings, a fresh walkthrough of key systems, scoping the system description and answering the first round of requests. Ask the new firm for its request list early and estimate effort from that list rather than from past cycles.

Can we switch SOC 2 auditors ourselves without outside help?

Yes, the decision and the contract are yours to manage, and many organizations run the switch with internal staff. What you cannot do is choose the examiner's conclusions or have an internal team issue the report, because only an independent CPA firm can do that. Internal staff typically handle the selection process, the evidence transfer and the scheduling. Outside help is most useful when the environment is complex, when the change coincides with a platform move, or when the team has no spare capacity during fieldwork.

What is the difference between switching a CPA firm and hiring a consultant?

A CPA firm is the independent service auditor that examines your controls and issues the SOC 2 report. A consultant helps you prepare: designing controls, building the evidence, and getting the system ready for examination. A consultant cannot issue or substitute for the report, and an auditor that also prepares your controls faces independence limits on what it can do. When you switch firms, you are changing the examiner. When you hire a consultant, you are changing who helps your team get ready, and the two roles should be kept distinct in your contracts.

What should we ask a new CPA firm before signing?

Ask about the firm's size and capacity, its references, the qualifications of the staff who will do fieldwork, and its peer review results. Confirm the license status of the individuals and the firm on the official CPAverify search, and check the AICPA Peer Review Public File for enrollment. Ask how the firm sets its fee, what sampling approach it uses, how it maintains independence, and what it expects from your team. Be wary of promises of compliance in weeks, referral marketing, or reports that look identical apart from the logo, and ask for the engagement letter before any work begins.

What can a readiness partner do during a switch?

A readiness partner can prepare the systems, control evidence, access reviews and handover documentation so that a new CPA firm can test efficiently. DeployOpen works under a fixed written scope agreed before work starts, so the boundaries of that help are known to both sides. In practice, this means assembling the control matrix and system description for the new firm's request list, pulling evidence for the current period from the systems that produce it, and confirming that tickets, pull requests, deployment records and access logs are complete and easy to sample. Where the outgoing firm left open findings or exceptions, the partner can document what was remediated, when, and what evidence now shows it.

DeployOpen does not issue SOC 2 reports, opinions or attestations. Only the independent CPA firm can do that. DeployOpen also does not select, vet or recommend a CPA firm for you. Checking the new firm's license, peer review result, references and examination approach is your decision, and you should make it with the firm's own answers and the public records described above. A readiness partner's work does not change the firm's independence or the scope it accepts, and the new firm may still ask for procedures you did not expect.

DeployOpen does not guarantee the outcome of any examination, including whether the new firm accepts the existing period, issues a clean opinion, or agrees to the timing you planned. Before you engage anyone, ask for the written scope to list the systems, evidence sets and handover documents included, the responsibilities split between your team, the partner and the auditor, and what is excluded. Confirm with the new firm which evidence format and sampling approach it will use, since that determines how much preparation is useful.

How DeployOpen prepares systems and evidence for a new auditor

DeployOpen works on the systems and evidence side of a change of CPA firm, not the opinion itself. We prepare your controls, configuration records and evidence so that the incoming firm can test them, while the independent firm you choose issues the report. Scope, build and handover are agreed in writing before work starts.

How we scope

Written scope covers which systems, criteria and report periods the new firm needs to test.
We map existing evidence to the criteria so the gap between old and new firm's requests is visible.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

We configure and document the evidence sources that the new firm's test procedures will draw on.
We run internal checks of access reviews, change records and logs against the agreed control descriptions.
We close gaps found in our checks before fieldwork, and record what changed and when.

How we hand over

You receive an evidence index and control documentation organized for the incoming firm's request list.
Documentation records the period boundaries, so the old and new reports can be read without a coverage gap.
The auditor selects samples and issues the report. We do not issue reports, attestations or certifications.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the handover.
We can answer the new firm's follow-up requests about how systems and evidence were prepared.
Retainer scope, like the original scope, is agreed in writing before it starts.