How to Choose a SOC 2 Auditor: What to Check Before You Sign

A SOC 2 auditor is a licensed CPA firm, and choosing one comes down to seven checks: that the firm is licensed, that it is enrolled in peer review, that it is independent of whoever built your controls, that it has examined companies like yours, that its fee covers what you think it covers, that it works with your evidence tooling, and that it shows you who will do the work. Price comes last, because the firm's name is on the first page of the report your customers read.

At a Glance

• Who can issue a SOC 2 report: a licensed CPA firm only. A SOC 2 examination is an attestation engagement under the AICPA's standards, described in its SOC suite of services.
• Who cannot: a consultant, a compliance software vendor, an ISO certification body, or SecureRoot. We prepare companies for the audit and do not issue reports.
• The rule that shapes everything: the auditor must be independent. A firm cannot design or operate your controls and then give an opinion on them.
• When to choose: before the audit period starts, not at the end of readiness. The auditor's view of scope and evidence should shape the controls, not arrive after them.
• What you are buying: an opinion your customers will rely on. A report from a firm they cannot verify is likely to be discounted, whatever it says.

Auditor, Consultant, Platform: Who Does What

Three kinds of company sell into a SOC 2 project, and buyers often mix them up because all three use the word "audit".

The roles are separate by design. Our guide to how to choose a SOC 2 consultant covers the readiness side; this page is about the firm that signs. For the wider question of which body can sign which kind of security report, see who can sign your security report.

The Seven Checks

1. The firm is a licensed CPA firm

This is a yes or no question, and it has a public answer. CPA firms in the United States are licensed by state boards of accountancy, and a firm's licence can be looked up with the board of the state that licenses it. Ask the firm which state it is licensed in and check. A firm that describes itself as a "SOC 2 certification body" or an "authorised SOC 2 auditor" without naming a CPA licence is describing something that does not exist.

2. The firm is enrolled in peer review

CPA firms that perform attestation work are subject to peer review, in which another firm inspects their engagements on a regular cycle, generally every three years. Ask for the firm's most recent peer review report and its result. A firm that performs SOC examinations and is not enrolled in peer review is the clearest warning sign on this list. A recently founded firm may not have completed its first review yet; in that case ask for proof of enrolment and the date the review is due.

3. The firm is independent of whoever built your controls

Independence is the reason the report is worth anything. The auditor cannot have designed your controls, written your policies or operated your evidence collection. Be cautious of a single invoice that bundles "readiness and audit" from the same company or from two companies under common ownership. Some arrangements of that kind are structured properly and some are not, and the question to ask is direct: who designed the controls, who is giving the opinion, and what is the relationship between them?

4. The firm has examined companies like yours

SOC 2 leaves a great deal to the auditor's judgement, and judgement comes from having seen similar systems. A firm that mainly audits other kinds of business may need time to understand a cloud-native system before it can test one. Ask how many SOC 2 reports the firm issued in the last year, how many were for cloud-hosted software companies of your size, and whether it has worked with Indian delivery teams and time zones before.

5. The fee covers what you think it covers

Auditor quotes are hard to compare because they bundle different things. Before comparing numbers, establish what each one includes: Type 1, Type 2 or both; which Trust Services categories; how many locations and systems; whether a readiness review or a bridge letter is included; what a re-test costs if exceptions are found; and what the renewal year costs. Our breakdown of SOC 2 certification cost in India sets out how the auditor's fee sits beside readiness and tooling.

6. The firm works with your evidence tooling

If you collect evidence through a compliance platform, ask whether the firm will test directly from it. An auditor who accepts read access to the platform can save your team a great deal of exporting screenshots. An auditor who insists on its own request list and spreadsheet, whatever tooling you run, will cost more of your time than the fee difference suggests.

7. You know who will do the work

The partner who sells the engagement is often not the person who tests your controls. Ask who the engagement manager will be, how many engagements they run at once, how requests and questions are handled, and what the firm's turnaround is from the end of fieldwork to a draft report. Ask to see a redacted sample report as well, because the quality of the system description and the test write-ups is visible on the page.

Questions to Put to Every Firm

Send the same questions to each firm on your shortlist, in writing, so the answers can be laid side by side.

Warning Signs

Some offers should end the conversation.

• A guaranteed clean report. No auditor can promise an unqualified opinion before testing. One that does is either not testing or not independent.
• A report in days. A Type 2 report covers a period of time, in practice usually three to twelve months. A Type 1 still needs a documented system description and an evaluation of control design. A report promised in a week has skipped the examination.
• "SOC 2 certified" on the engagement letter. SOC 2 is an attestation, and the output is a report with an opinion, not a certificate. A firm that sells a certificate is selling the wrong product.
• A price far below every other quote. The work has a floor. A quote well under it usually means sampling that will not hold up, or junior staff working from a template.
• No questions about your system. An auditor who quotes without asking about your architecture, headcount and scope has not scoped anything.

A weak report can cost more than a strong one in the end. If a customer's security team rejects it, you may pay for a second audit and lose the deal's timeline as well.

Indian Company, US Auditor: How It Works in Practice

Indian companies pursuing SOC 2 commonly work with a US-licensed CPA firm, either directly or with an India-based team performing fieldwork under that firm's supervision and sign-off. Three things are worth settling early.

The first is who signs. The report should be issued and signed by the licensed CPA firm, and that firm's name is what your customer sees. Ask which entity signs and check that entity's licence, not the affiliate's.

The second is how fieldwork runs. For a cloud-hosted company it is usually largely remote: walkthroughs over video, evidence through a platform or shared folder, and sampling from system exports. Ask about overlap hours and how quickly requests are turned around.

The third is how you pay. Fees quoted in US dollars to an Indian company carry tax and remittance questions that your finance team should look at before signing, not after the first invoice.

How SecureRoot Fits In

SecureRoot is on the readiness side. We scope the engagement, run the gap assessment, design the controls, set up evidence collection and support you through the audit, as set out on our SOC 2 service page. Our published range for that work is Rs 1.5 lakh to Rs 4.5 lakh.

We are not a CPA firm and we do not issue SOC 2 reports. We work with partner CPA firms who quote their own fee during scoping, and you contract with the CPA firm directly. The seven checks above apply to our partners exactly as they apply to anyone else, and we would rather you ran them.

Frequently Asked Questions

Who can perform a SOC 2 audit?

Only a licensed CPA firm can perform a SOC 2 examination and issue the report. SOC 2 is an attestation engagement under standards set by the AICPA, and in the United States attestation reports may be issued only by a licensed CPA firm. Consultants, compliance software vendors, penetration testing companies and ISO certification bodies cannot issue one, whatever their marketing suggests. They can prepare you for the audit, and most companies need that help, but the opinion has to come from the CPA firm. The firm does not need to be large. Specialist firms that concentrate on SOC work exist, and one of them can be a sound choice. What matters is that the licence is real and current, that the firm is enrolled in peer review, and that it had no hand in designing the controls it is now being asked to give an opinion on.

Can the same company do our readiness work and the audit?

Not properly. Independence is a core requirement of an attestation engagement, and a firm that designs your controls, writes your policies or runs your evidence collection cannot then give an independent opinion on whether those controls work. Some CPA firms offer a readiness assessment before the audit, which is acceptable when it stays at the level of pointing out gaps and you or a separate consultant do the fixing. The line is crossed when the auditor makes management decisions for you or builds what it will later test. Be cautious with bundles that sell readiness and the report together through related companies. Ask plainly who designed the controls, who signs the opinion, and how the two are connected. If the answer is unclear, a customer's security team may reach the same conclusion you did and discount the report accordingly.

Does the size of the audit firm matter?

Less than buyers assume. A report from one of the largest global firms carries weight, but it typically costs more than a specialist firm charges, and many enterprise security teams do not require it. What reviewers look for is whether the firm is a licensed CPA firm, whether it is known for SOC work, and whether the report itself is thorough. A specialist firm that issues SOC 2 reports for software companies all year round will often produce a sharper system description and more relevant testing than a generalist firm that does a handful. The exception is when a specific customer names the firms it will accept, which some banks and large enterprises do. Check your most important customer's vendor requirements before choosing, because a report they reject may have to be redone with a different firm.

When should we engage the auditor?

Earlier than most companies do. The common mistake is to finish readiness and then look for an auditor, which leaves the firm's view of scope, control wording and evidence format to arrive after everything has been built. Engage the firm once your scope is settled and before the Type 2 period starts, or a few weeks before the Type 1 date. That lets the auditor confirm the Trust Services categories, review the system boundary, and tell you how it will sample, so the evidence you collect from the first day is evidence it will accept. Audit firms' calendars also fill up, so a search that starts late can push the report back by weeks. Signing early does not usually change the fee, though you should ask the firm to confirm, and fieldwork is simply scheduled for when you are ready.

What does a qualified opinion mean, and can we avoid one?

A qualified opinion means the auditor concluded that your controls met the criteria except in one or more stated respects. It is different from an exception, which is a single test that failed and is listed in the results section. A report can contain a few exceptions and still carry an unqualified opinion when they are minor or isolated. An opinion is qualified when the problem is material, typically a criterion not met, but not pervasive. Customers read both, and a qualification usually triggers follow-up questions and a request for a remediation plan. You avoid one by running controls for some weeks before the period starts, checking evidence monthly so gaps are caught while they can still be fixed, and scoping only what you can operate. You cannot avoid one by choosing a lenient auditor, because a report that glosses over failures loses its value with the first careful reader.

Where to Start

Settle your scope first: which report type, which categories, which systems. Then send the question list above to two or three firms and compare the answers before you compare the fees. If you want help scoping the engagement, or an introduction to a partner CPA firm once you have, request an assessment and we will start there.