There is exactly one hard requirement when you choose a SOC 2 auditor, and it is not a matter of preference: the examination has to be performed by a licensed CPA firm. SOC reports are attestation engagements performed under AICPA standards, and the opinion has to be signed by a firm licensed to issue it. A consultancy, a security boutique or a software platform cannot sign one, no matter how good the underlying work is.
Past that filter, firms differ in ways that are legitimate rather than right or wrong — size, staffing model, pricing structure, how much hand-holding they include, how quickly they turn a report around. What follows is a set of questions that get at those differences. They are worth asking every firm you speak to, including ours, and the useful signal is often in how directly a firm answers rather than in the answer itself.
Confirm the licence, not just the letters
Ask for the firm’s name as licensed and the state board it is licensed with, then verify it. Most state boards publish a searchable licensee registry, and the check takes a couple of minutes.
This matters because arrangements exist where a consultancy does the work and a CPA firm signs the report. That is not automatically improper — firms use subcontractors and specialists routinely — but you should know who is engaged, who is responsible for the opinion, and who is standing behind the report when your customer’s procurement team asks questions about it in two years. Ask plainly: is your firm the one issuing the opinion, and is any part of the engagement performed by another organisation?
Peer review, and what it does and does not tell you
Firms performing attestation engagements are generally subject to peer review, though the specific requirement depends on state board rules and on AICPA membership. Ask two questions rather than one:
- What is the date and result of your most recent peer review?
- Was a SOC engagement selected as part of that review?
The second question is the one people miss. A firm can hold a clean peer review report where the engagements selected were financial statement audits and no SOC work was examined. That is not a scandal — selection depends on the firm’s practice mix — but it means the review says less about their SOC work than it appears to. A firm should be able to answer both without hesitation and provide the report.
Who will actually do the work
Business development and fieldwork are frequently different people. That is normal in every professional services firm. What you want to know is the shape of it:
- Who is the day-to-day contact during fieldwork, and what is their experience with SOC engagements?
- Who reviews the work, and who signs the report?
- Is any testing performed by contractors or by staff outside the firm, and if so, where and under whose supervision?
- Have they examined companies with a similar architecture to yours — same cloud provider, similar deployment model, similar use of subservice organisations?
The last one is worth more than industry vertical experience in most cases. An auditor who has never tested infrastructure-as-code deployments will spend your time learning, and you will pay for the learning either in hours or in a control matrix that does not fit how you actually work.
Ask to speak with the person who would run the engagement, not only the person selling it.
Independence, especially if they helped you prepare
This is the question to raise early, before anyone has done any work for you.
Auditor independence is governed by professional conduct rules, and the core idea is that a firm cannot audit its own work. Designing or implementing your controls, writing your policies, or making management decisions on your behalf creates a self-review threat that can impair independence for the examination that follows.
Readiness work sits on a spectrum. Identifying gaps and explaining what the criteria require is generally on one side of the line; drafting your control set and then testing it is on the other. Firms take genuinely different positions on where the line falls and what safeguards they apply, and you should ask any firm to explain theirs in specific terms rather than accept a general reassurance.
Two follow-ups worth asking:
- If you perform our readiness assessment, does that affect your ability to perform the examination, and how do you manage that?
- If you also perform our penetration testing or other security work, does that change anything?
There are reasonable answers to both. The point is to hear the firm reason about it rather than wave it away, because if independence is impaired the report is compromised in a way that is expensive to discover late.
How the firm handles exceptions
Every auditor finds things. What differs is the process around them, and this is where you learn the most about what working with a firm will feel like.
Ask: if you identify an exception in month two of a twelve-month period, what happens? Reasonable answers involve telling you promptly, letting you remediate, and reporting both the exception and the remediation. Answers that involve holding findings until the end of fieldwork are a warning about communication style.
Then ask how exceptions are presented in the report, how management responses are handled, and under what circumstances the firm would modify the opinion. Ask for a redacted sample report and actually read the testing section — you are looking at how clearly the tests are described, whether the control descriptions read as bespoke or as boilerplate, and whether an exception, if present, is explained in a way a reader can assess.
A firm that tells you exceptions are unlikely, or that clients of theirs do not get them, is telling you something about their testing rather than about their clients.
Timeline, communication and fees
Practice varies widely here, so ask for specifics rather than assurances:
- When do we receive the evidence request list, and in what format?
- What is your expected response time to questions during fieldwork?
- How long from the end of the observation period to a draft report, and to a final report?
- What happens to the timeline if we are slow providing evidence, and does that change the fee?
- Is the fee fixed or hourly, and what specifically triggers a change in scope or price?
- Are bridge letters, additional report copies, or answering customer questionnaires included, or billed separately?
On price, a quote materially below others is not automatically a problem, but it is a question. Ask what accounts for it — a smaller sample approach, a narrower scope, more work pushed onto you, or simply lower overheads. Any of those can be the right trade for your situation as long as you chose it knowingly.
Answers that should give you pause
A few responses are worth treating as red flags with any firm:
- Any promise of a clean opinion, a guaranteed pass, or a commitment to the outcome before testing
- A quoted price before anyone has understood your systems, criteria and subservice organisations
- Reluctance to name who performs the fieldwork or to put you in touch with them
- Vagueness about peer review status or licensing
- An offer to write your policies and controls and then examine them, without any discussion of independence
- Pressure to sign quickly because of a discount that expires
What to do next
Talk to at least three firms and put the same eight or ten questions to each, written down in advance. Compare the answers side by side rather than reacting to whoever you spoke to last, and weight two things heavily: the independence answer, and the exception-handling answer. Those two predict most of what the engagement will actually be like.
Assurion is a licensed CPA firm performing SOC 1, SOC 2 and SOC 3 examinations, and we are happy to answer every question on this list about our own practice.