A SOC 2 report is only as credible as the firm that signed it, and customers increasingly check who that was. This buyer's guide is for founders, compliance leads and security managers choosing a CPA firm for a SOC 2 Type 1 or Type 2 examination. It covers licensing and peer review checks, independence when a compliance automation platform is involved, how cost and timeline are set, bridge letters, the questions to ask and the warning signs. It does not explain the framework itself: see the SOC 2 Guide and, for reading the output, the How to Read a SOC 2 Report Guide.
Key takeaways
- Only a licensed CPA firm can sign. The AICPA describes SOC as services CPAs provide under AICPA standards, and says it refers unlicensed firms, and firms not enrolled in peer review, to regulators including state boards of accountancy.
- Verify, do not trust the badge. Check the firm on CPAverify, which draws on state board licensing data, and on the AICPA Peer Review Public File.
- Platform partnerships carry ethics risk. In April 2026 the AICPA issued Ethics Staff Insights on business arrangements with SOC 2 tool providers, and the Journal of Accountancy listed red flags such as provider-set fees and undisclosed referral payments.
- Price follows scope. No official fee schedule exists. Categories in scope, system boundary, Type 1 or Type 2, period length and locations drive effort.
- Plan for continuity. Customers expect reports with no coverage gaps; choose a firm that can run consecutive periods and support bridge letters.
Define requirements
- Report type: Type 1 (design at a point in time) to unblock early deals, or Type 2 (operating effectiveness over a period), which most enterprise buyers ask for.
- Trust services categories: Security is always in scope; add Availability, Processing Integrity, Confidentiality or Privacy only where customer contracts demand them.
- System boundary: products, infrastructure, locations, subservice organisations (carve-out or inclusive) and complementary user entity controls.
- Customer asks: collect the security questionnaires and contract clauses that triggered the audit. Some customers also want other frameworks mapped into the report (SOC 2+), which affects firm choice.
- Tooling: whether you use a compliance automation platform, and whether you want the auditor to rely on evidence from it.
- Dates: the date a customer needs the report and, for Type 2, the period start date that makes that achievable.
Small versus large organisations: a start-up with one cloud product and Security only can choose a smaller firm with SaaS experience and a fixed fee. A larger organisation with several products, regions, subservice organisations and SOC 1 or ISO/IEC 27001 needs a firm with capacity for combined testing, an experienced engagement partner and IT audit specialists.
Capability areas
| Area | What to look for | How to check |
|---|---|---|
| Licensing | Firm permit and licensed CPA signing the opinion in a state that permits the practice | CPAverify search for firm and engagement partner; disciplinary markers |
| Peer review | Enrolled in the AICPA Peer Review Program with a recent accepted review | AICPA Peer Review Public File search; firm terminations list |
| Independence | No role in designing or operating your controls; written policy on tool provider arrangements | Independence representation, disclosure of referral or revenue arrangements |
| Technical depth | IT auditors who understand your cloud, identity and CI/CD stack | Team CVs, sample test procedures for CC6 logical access and CC8 change management |
| Methodology | Clear sampling, walkthroughs, inspection of system-generated evidence and exception handling | Engagement letter, request list, sample management letter (redacted) |
| Report quality | Specific system description, tests described in enough detail to judge, exceptions reported honestly | Redacted sample report from a comparable client |
| Continuity | Capacity for back-to-back periods; partner and team stability year to year | Multi-year proposal, named staff |
Evaluation criteria
| Criterion | Strong answer | Weak answer | Weight |
|---|---|---|---|
| Licence and peer review | Verified on CPAverify and Peer Review Public File | "We are AICPA-approved" (no such designation; the JofA warns against the claim) | Gate |
| Tool provider relationship | Auditor sets the fee, controls scope, timing and evidence; any arrangement disclosed in writing | Fee set or bundled by the platform; exclusive cross-referrals | Gate |
| Evidence approach | Uses platform evidence as a source, then tests completeness and accuracy and inspects systems directly | Relies only on screenshots exported by the platform | High |
| Timeline realism | Schedule tied to your readiness and period; fieldwork and report dates in writing | Promised report date regardless of readiness | High |
| Exception handling | Explains how deviations are described and how the opinion could be qualified | "Our clients always get clean reports" | High |
| Commercial terms | Itemised fee by phase; clear charges for added categories, extra locations and re-testing | Single price with undefined scope | Medium |
| Sector fit | Experience with your customers' expectations (financial services, healthcare, public sector) | Generic SaaS template only | Medium |
Cost and timeline: ask for a written estimate per phase (readiness if separate, Type 1 or Type 2 fieldwork, reporting) and compare like for like. A Type 2 report cannot be issued until the observation period has ended and testing is complete, so the period start date, not the signing of the engagement letter, usually fixes when you can share the report. If the same firm offers readiness consulting, ask how independence is preserved: advising on gaps is different from designing or running your controls.
Questions to ask vendors
- Which licensed CPA will sign the report, in which state, and what does CPAverify show for the firm?
- When was your last accepted peer review, and is it in the public file?
- Do you have any referral, revenue-share, reseller or ownership arrangement with our compliance platform? Who sets your fee?
- Will anyone from the platform observe fieldwork or receive our findings?
- Which evidence will you take from the platform, and how do you test its completeness and accuracy?
- Who are the IT auditors on the team, and have they audited environments like ours (Kubernetes, multi-cloud, workload identities)?
- How do you test logical access for service accounts, API keys and other non-human identities under CC6?
- What happens if you find deviations: how are they described, and when would the opinion be qualified?
- Can you support consecutive Type 2 periods and confirm a report date for each?
- Do you offer SOC 2+ or combined testing with SOC 1 or ISO/IEC 27001, and how is that priced?
Red flags
- Guaranteed outcomes: a "clean audit" or "100% pass rate" promise, which the Journal of Accountancy names as a problem.
- Platform-controlled engagements: the tool provider sets the fee, deadlines or scope, or sits in on auditor discussions.
- Undisclosed referral payments: money flowing between auditor and platform without written disclosure to you.
- No verifiable licence or peer review: the firm cannot be found on CPAverify or the Peer Review Public File, or appears on the terminations list.
- Thin reports: boilerplate system descriptions and tests that only say "inspected evidence" with no detail. Your customers will notice, and weak access testing can leave standing credentials and unowned service accounts unexamined. See the Orphaned and Dormant Accounts guide.
- Days-long Type 2: unusually fast fieldwork for a complex system suggests limited testing.
Proof of concept
- Shortlist three firms and verify each on CPAverify and the AICPA Peer Review Public File before any sales call.
- Send the same scope pack (categories, boundary, subservice organisations, platform use, target dates) and request itemised proposals.
- Ask each firm for a redacted sample report and request list; compare the specificity of tests for access, change management and incident response.
- Hold a scoping call with the proposed engagement partner and IT audit lead, not only sales staff.
- Obtain written disclosure of any tool provider relationship and confirm the auditor sets fee, scope and timing.
- Negotiate the engagement letter: deliverables, report date, re-testing fees and multi-year terms, then plan bridge letters for the gap between period end and the next report.
How NHI Mgmt Group can help
We provide independent identity and non-human identity advisory and evaluation support, including SOC 2 access control readiness. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: SOC 2 Guide · How to Read a SOC 2 Report Guide · SOC 2 Readiness Checklist · Third-Party Risk Management Guide