Buyer's guide
How to choose a SOC 2 audit firm and compare quotes
Your SOC 2 audit firm must be a licensed CPA firm. Beyond that, fit and price vary widely, so a few questions save a lot of money and frustration.
- Preparation, not the examination
- A licensed CPA firm signs the report
- Plain-English guidance
What every SOC 2 audit firm must be
Only a licensed CPA firm can issue a SOC 2 report under AICPA standards. Therefore check licensing first. Also, the firm must be independent: it cannot examine controls it designed for you.
Quote ranges you will see
The same company with the same scope can receive very different quotes.
| Firm type | Indicative quote for one scope |
|---|---|
| Boutique | About $15,000. |
| Mid-tier | About $35,000. |
| Big Four | About $90,000. |
Score a SOC 2 audit firm
Tick each point a firm answered well. Use it once per proposal.
Your result appears here as you tick, so you can see what is still open.
Questions to ask a SOC 2 audit firm
Ask the same questions of every firm, so answers are comparable.
- How many SOC 2 examinations do you perform each year?
- Do you know our cloud provider and tools?
- Who will lead our engagement?
- What evidence format do you accept?
- Is the fee fixed for the agreed scope?
Warning signs in a SOC 2 audit firm quote
A quote of $3,000 to $5,000 for a full examination is a warning sign, because there are too few hours to test properly. Also be wary of anyone offering a SOC 2 certificate or badge, since no such thing exists.
How we fit alongside your firm
We are not a CPA firm. So we prepare you, and then you hire an independent SOC 2 audit firm for the examination. We stay alongside during fieldwork to answer questions. Reference: AICPA guidance on SOC 2.
Meet more than one firm before deciding. Ask each to explain how it handles exceptions and what its draft report review looks like. Also ask for an engagement timeline, because a firm that cannot start until after your deadline is no use however good it is. Finally, confirm in writing what the fee includes, such as travel, report revisions and any bridge letter, so the comparison between quotes stays fair.
SOC 2 audit firm questions
Does a Big Four SOC 2 audit firm make the report better?
Not necessarily. Buyers mainly care that the firm is licensed and the opinion is clean.
Can our consultant also be the SOC 2 audit firm?
No. Independence rules forbid it.
When should we choose the firm?
Early, because good firms book ahead.
Can we switch firms next year?
Yes, although continuity can make renewals smoother.
Related guides
Get ready before the firm arrives
Tell us your timeline. We reply with a written scope and a fixed preparation fee, so fieldwork goes smoothly.
Scope your preparation