How to Choose a SOC 2 Auditor: 9 Questions to Ask

The vetting checklist we recommend: license verification, team, fees, scope boundaries, and the red flags that signal a bad fit.

Start with the non-negotiable

SOC 2 reports can only be issued by licensed CPA firms under AICPA attestation standards. That is the entire credential that matters. A compliance platform, a consultant, and a penetration-testing shop can all prepare you — none can sign the report. Verify the license before anything else.

The 9 questions

1. Are you a licensed CPA firm, and which entity signs the report?
   Some firms operate under affiliate names in certain states (e.g., 360 Advanced notes it may operate as Hiestand, Brand, Loughran, P.A.). Know whose name goes on your report.
2. Who is my actual engagement team?
   Partner bios in the pitch deck mean nothing if interns do the fieldwork. Ask for the manager and senior who will test your controls — and their SOC 2 count.
3. Fixed fee or hourly — and what breaks the fixed fee?
   Fixed fees are standard among specialists (Schellman, for example, states it doesn't charge by the hour). Get scope boundaries in writing: what triggers a change order?
4. How do you price added Trust Services Criteria?
   Each criterion beyond Security typically adds 15–25%. Confirm the math now, not mid-audit.
5. What's your experience with our stack?
   AWS vs Azure vs GCP, monolith vs microservices — an auditor who knows your architecture tests faster and asks smarter questions.
6. How do you handle evidence collection?
   Do they integrate with your compliance platform (Vanta, Drata, Secureframe), or will your team be screenshotting into spreadsheets for weeks?
7. What does your timeline look like from engagement to report?
   Then ask what they need from you to hit it. The bottleneck is almost always the client.
8. Can you bundle other frameworks?
   If ISO 27001 or HIPAA is on your roadmap, one firm doing combined audits shares evidence and cuts total cost.
9. Can I talk to two reference clients my size?
   Not logos — conversations. Ask those references: did the fee hold, did the timeline hold, and would they re-engage?

Red flags

• Guaranteed clean report. There is no pass/fail, and no ethical auditor pre-promises the opinion.
• Won't name the engagement team. You're buying people, not a brand.
• Vague scope, lump-sum fee. "SOC 2: $30k" with no criteria, no period, no system boundaries is a change order waiting to happen.
• They also sell you the remediation. The firm that finds the gaps shouldn't be the one billing to fix them — independence matters.

Boutique vs large firm

The report format is standardized by the AICPA, so a clean report from a boutique carries the same structural weight as one from a national firm. What differs: bench depth, bundled frameworks, and price — boutiques often run 20–40% cheaper. Match the firm to your complexity, not your aspirations. Browse verified auditor profiles or get matched.

Keep reading

Questions