How to Choose a SOC 2 Auditor: 12 Checks Before You Sign

To choose a SOC 2 auditor, vet the audit firm before you sign: confirm that it is a licensed CPA firm, look up its AICPA peer review results, ask whether it has any financial or referral relationship with your compliance platform, find out how many hours the engagement partner will spend on your audit, and ask how the firm tailors its risk assessment and sample sizes to your environment. A firm that cannot answer those five questions clearly is a risk to every deal that depends on its report.

This guide explains why those checks matter more in 2026 than at any point since SOC 2 became the default B2B security requirement, and gives you a 12-point checklist, the exact questions to ask on a first call, and the red flags that should stop you from signing.

Why does choosing a SOC 2 audit firm matter more in 2026?

Choosing a SOC 2 audit firm matters more in 2026 because the profession's own oversight body has started treating cookie-cutter SOC 2 engagements as a quality failure, and enterprise buyers have noticed. The question security reviewers ask is no longer only "do you have a SOC 2 report?" It is "who issued it, and can we rely on it?"

Three developments drove the change.

1. The Delve allegations put boilerplate reports in the spotlight. In early 2026, an anonymous whistleblower analysis reported that 493 of 494 SOC 2 reports tied to the compliance platform Delve contained near-identical boilerplate text, including the same grammatical errors (IANS Research). Delve disputed the claims and stated that final reports and opinions are issued solely by independent, licensed auditors (Delve). Whatever the outcome of that dispute, the episode taught every procurement team to ask a new question about the auditor behind a report.

2. The AICPA Peer Review Board issued a SOC 2 reviewer alert. On May 14, 2026, the Journal of Accountancy reported that the Peer Review Board had been monitoring firms performing SOC 2 engagements, including high-volume providers using third-party platforms (Journal of Accountancy). The alert names a specific risk: engagements that are not designed around the service organization's own risks and that produce identical reports, risk assessments, sample sizes, and testing procedures. Where reviewers see elevated risk, they are expected to select roughly five SOC 2 engagements from different partners, compare them with each other and with prior-year reports, and classify improperly performed engagements as nonconforming. Starting June 1, 2026, AICPA staff began identifying scheduled peer reviews of firms with SOC 2 practices and contacting review team captains early.

3. AICPA ethics staff addressed tool-provider relationships directly. On April 13, 2026, AICPA ethics staff published an Ethics Staff Insights resource on business arrangements with SOC tool providers, warning that these relationships can raise significant threats to compliance with the AICPA Code of Professional Conduct (AICPA & CIMA). The companion Journal of Accountancy article lists threats including undue influence, self-interest tied to fee arrangements, provider-driven deadlines, and contract terms that restrict what the auditor can tell the client (Journal of Accountancy).

The practical result: a SOC 2 report from a firm that later receives a peer review deficiency tied to its SOC 2 practice can trigger extra questions from every customer who relies on it. That is the risk you are managing when you vet a SOC 2 audit firm.

What makes a SOC 2 report acceptable to enterprise buyers?

A SOC 2 report is acceptable to enterprise buyers when it is issued by a licensed CPA firm in good standing, covers the services and period the buyer cares about, and shows evidence of real, environment-specific testing. Buyers do not accept a SOC 2 report because it exists. They accept it because they can rely on it.

Mature third-party risk management (TPRM) teams typically look at four things before they read a single control:

The last row matters more than most founders realize. Experienced reviewers know that a large report with zero exceptions, generic test language, and identical sample sizes across controls of different frequencies can signal shallow testing rather than a perfect environment. Our guide on how to verify a SOC 2 report covers the buyer side of this review in detail.

How to vet a SOC 2 audit firm: the 12-point checklist

Use this checklist before you sign any SOC 2 engagement letter. Each check takes minutes, and together they cover the risks the AICPA itself has flagged.

The sections below explain how to run the checks that need more than a single question.

How do you check a SOC 2 auditor's AICPA peer review?

You check a SOC 2 auditor's AICPA peer review by searching the firm's name in the AICPA Peer Review Public File at peerreview.aicpa.org, then reading the rating, the review period, the acceptance date, and any letter of response. CPA firms that perform attest engagements such as SOC 2 examinations are generally required to undergo peer review, typically once every three years.

Peer review results come in three ratings:

• Pass: The firm's system of quality management was suitably designed and complied with in all material respects.
• Pass with deficiency (or deficiencies): The reviewer found a deficiency, or deficiencies, that could cause the firm not to perform or report in conformity with professional standards in one or more important respects.
• Fail: The reviewer found significant deficiencies.

How SOC 2 firms actually score is instructive. A March 2026 analysis of peer review records for 261 SOC 2 firms found that 73.9% had a public clean Pass, 11.9% had results hidden from the public file, 6.5% had an aging or overdue review, 2.7% had a Pass with deficiencies, 3.4% were enrolled but had never been rated, and 1.5% had failed (Secureframe). In other words, roughly one in four SOC 2 firms in that sample did not have a current, public, clean result.

How to read what you find:

1. No listing at all. Ask the firm directly. A firm that is not enrolled in peer review should not be signing SOC 2 reports.
2. Rating hidden. Many firms are not required to make results public. A hidden rating is not a failing rating, but you are entitled to ask for the peer review report and the letter of response.
3. Review is old. A review completed before the firm scaled its SOC 2 practice may not reflect how the firm performs SOC 2 work today. Ask when the next review is scheduled and whether SOC engagements were in the last sample.
4. Pass with deficiency. Read the deficiency. A deficiency in an unrelated area, such as employee benefit plan audits, matters less to you than one involving SOC engagements.

One more point that most buyers miss: given the May 2026 reviewer alert, a firm's next peer review is likely to look harder at its SOC 2 work than its last one did. A firm with a large, highly standardized SOC 2 practice is carrying risk that has not yet shown up in its public record.

Is the firm licensed to issue a SOC 2 report?

Only a licensed CPA firm can issue a SOC 2 report, because a SOC 2 examination is an attestation engagement performed under the AICPA's Statements on Standards for Attestation Engagements, specifically AT-C Section 205. Compliance platforms, readiness consultants, and penetration testers can help you prepare, but none of them can issue the report.

Check three things:

• The signing entity. Look at the firm name on a sample report or in the draft engagement letter. Make sure it matches a licensed CPA firm.
• State licensing. Verify the firm's license through the relevant state board of accountancy or CPAverify.
• Who does the work. Many legitimate firms use staff in other countries under the supervision of licensed CPAs. That model is not a problem in itself. Lack of supervision is. Ask how fieldwork is reviewed and who signs off.

Is the auditor independent from your compliance platform?

An auditor is independent from your compliance platform when the platform has no ability to influence the auditor's fee, scope, timeline, evidence, or conclusions. Independence is not just a box on the report. It is the reason a buyer can rely on a report written about you by someone you paid.

The April 2026 AICPA ethics guidance identifies arrangement types that deserve scrutiny:

• Bundled services where the platform sells a package that includes the SOC 2 examination and sets the exam fee.
• Contract terms that let the platform change the exam fee unilaterally, or require the auditor to pay the platform for access to evidence.
• Cross-referral arrangements, especially concentrated or exclusive referrals from one platform. Under the AICPA Code, referral fees require written disclosure to the client (ET Section 1.520.001).
• Platform involvement in the exam, such as contractual rights to observe the auditor's work or sit in on auditor and client discussions.
• Provider-driven deadlines that ignore the auditor's judgment about scope, risk, staffing, and evidence.
• Restrictive clauses, such as non-disparagement terms that could prevent the auditor from communicating required matters to you.

The guidance is clear that auditors should set their fees independently and retain control over scope, timing, evidence, and deficiency communication, and should decline or discontinue arrangements where safeguards are not available.

Using a compliance automation platform is not the problem. Platforms like Vanta, Drata, and Sprinto are widely used, and many reputable firms audit clients who use them. The problem is an arrangement where the platform's commercial interests shape the audit. Ask your auditor, in writing, to disclose any arrangement with your platform and to explain how the firm protects its independence. A confident firm will answer in one email.

How involved will the engagement partner be?

The engagement partner signs the opinion and is professionally responsible for it, so the partner's involvement is one of the best predictors of audit quality. Ask how many hours the partner will spend on your engagement, at which stages, and whether you will meet them.

A good answer names the partner, describes involvement in planning and risk assessment, and explains how the partner reviews exceptions and the final report. A weak answer is a promise that "the partner reviews every report" with no detail about when or how. High-volume models can stretch partner review so thin that it becomes a signature step rather than a judgment step, and that is exactly the pattern the Peer Review Board's alert describes as a firm-level quality risk.

How fast is too fast for a SOC 2 audit?

A SOC 2 audit is too fast when the timeline leaves no room for walkthroughs, inquiry of your personnel, evaluation of evidence, and follow-up on exceptions. The AICPA has not published a minimum number of days, but the May 2026 peer review alert specifically directs reviewers to assess the reasonableness of SOC 2 engagement timelines and flags quick-turn engagements that appear unreasonable.

Remember what each report type requires:

• SOC 2 Type 1 evaluates the design of controls at a point in time. It can be completed relatively quickly once controls are in place, but the auditor still needs to understand your system and evaluate design.
• SOC 2 Type 2 evaluates operating effectiveness over a period, commonly 3 to 12 months. The auditor must test samples drawn from across that period. No vendor can compress the observation period itself.

Watch for these timeline red flags:

• A report delivered within a few days of the evidence upload, with no walkthrough meetings.
• No interviews with anyone outside the compliance lead.
• No questions about your evidence before the report is issued.
• A contract that guarantees a delivery date regardless of what fieldwork finds.

Will testing be tailored to your environment?

Testing is tailored to your environment when the auditor's risk assessment, control selection, sample sizes, and test procedures reflect your actual systems, people, and processes. This is the heart of the AICPA's 2026 concern. Identical risk assessments, sample sizes, and procedures across different clients suggest the work was not designed around each client's risks.

Ask a prospective auditor to describe, without naming clients, how two recent engagements differed in their risk assessment and testing approach. Then ask how sample sizes are set. A credible firm will explain that sample sizes depend on control frequency (annual, quarterly, monthly, weekly, daily, or many times per day) and population size, and that the same control may be tested differently at two clients. Our guide to SOC 2 sample sizes explains the common approaches.

Also ask how the firm treats your system description. Under the AICPA's Description Criteria (DC Section 200), the description in Section 3 must describe your system, not a generic one. If the firm offers to write your description from a template with your name swapped in, treat that as a warning. See our guide to DC Section 200 system descriptions.

Red flags that should stop you from signing

Stop and reconsider before signing with any SOC 2 audit firm that shows one or more of these signs:

• It guarantees a clean opinion. No independent auditor can promise an outcome before testing. The AICPA's ethics guidance specifically warns against marketing that implies guaranteed outcomes.
• The platform sets the price. If your audit fee was fixed as part of a software bundle, ask who the auditor's client really is.
• It cannot show you a peer review result. Hidden results are allowed. Refusing to share them is a choice.
• It offers to write your controls, policies, and system description, and then audit them. Designing and then testing your own work is a self-review threat. Readiness help and the audit should come from different firms.
• Its timeline is measured in days. Fast is fine. Implausible is not.
• It has never issued a report with exceptions. Exceptions are normal. A firm that never finds any is either very selective about clients or not testing deeply.
• Its sample report is generic. Ask for a redacted sample. If the test procedures read like a template, yours will too.

Cheap and fast vs. thorough: what does the wrong auditor really cost?

The wrong auditor costs more than the price difference between quotes, because the real cost arrives later as rejected reports, stalled deals, and a second audit. A SOC 2 report exists to shorten sales cycles. A report that triggers additional scrutiny lengthens them.

If your company is closing large enterprise deals, the cost of one delayed contract can exceed the entire audit fee difference. That is the number to compare against the cheaper quote.

Questions to ask a SOC 2 audit firm on the first call

Ask these ten questions on your first call with any prospective SOC 2 auditor. Write down the answers and compare firms side by side.

1. Which licensed CPA firm signs the report, and which partner will sign ours?
2. What is your most recent peer review rating, and did that review include SOC engagements?
3. Do you have any referral, revenue-sharing, marketing, or contractual arrangement with our compliance platform?
4. Who sets your fee, and what assumptions is it based on?
5. How many hours will the signing partner spend on our engagement, and at which stages?
6. How do you perform the risk assessment for a new client?
7. How do you determine sample sizes for controls with different frequencies?
8. What does your fieldwork timeline look like, step by step?
9. How and when do you communicate potential exceptions?
10. Can we speak with two clients who have used your reports in enterprise sales?

What should you do if your current SOC 2 report came from a questionable firm?

If your current SOC 2 report came from a firm you now have doubts about, do not panic and do not hide it. Check the firm's peer review status, prepare a short, factual explanation for customers who ask, and select a well-vetted firm for your next examination period.

A practical sequence:

1. Confirm the facts. Look up the firm's licensing and peer review status. Many firms that work with automation platforms are reputable.
2. Prepare a buyer response. If customers ask, explain when your current period ended, which firm will perform your next examination, and when the report is expected.
3. Run an independent gap assessment. Before the next period begins, have someone independent of both your platform and your next auditor test whether your controls actually operate the way your description says.
4. Choose the next auditor using the checklist above. Start the next observation period with controls you know are working.

Ledger Audits runs a Gap Sprint, a fixed-scope readiness assessment against the SOC 2 Trust Services Criteria that delivers a control matrix, an evidence requirements map, and a prioritized remediation roadmap. Ledger Audits does not issue SOC 2 reports, which keeps readiness work separate from the independent examination your CPA firm performs. Book a Gap Sprint call.

Related reading

• How to Verify a SOC 2 Report: An 8-Point Auditor's Check
• SOC 2 Sample Sizes: What Your Auditor Will Actually Pull
• How to Write a SOC 2 System Description That Meets DC Section 200
• SOC 2 Exceptions vs. a Qualified Opinion
• SOC 2 for AI Agents and LLM Features

Frequently asked questions

How do I choose a SOC 2 auditor?

Choose a SOC 2 auditor by confirming the firm is a licensed CPA firm, checking its AICPA peer review results, asking about any arrangement with your compliance platform, confirming how much time the signing partner will spend on your engagement, and asking how the firm tailors risk assessment and sampling to your environment. Then compare references from clients who sell to buyers like yours.

Can any company issue a SOC 2 report?

No. Only a licensed CPA firm can issue a SOC 2 report, because the SOC 2 examination is an attestation engagement performed under AICPA attestation standards (AT-C Section 205). Compliance platforms, consultants, and security vendors can help you prepare, but they cannot issue the report or the opinion.

How do I look up a SOC 2 auditor's peer review?

Search the firm's name in the AICPA Peer Review Public File at peerreview.aicpa.org. Review the rating, the review period, the acceptance date, and any letter of response. If the rating is hidden, ask the firm for its peer review report directly.

Is a cheap SOC 2 audit worth it?

A cheap SOC 2 audit is worth it only if enterprise buyers accept the report. If a low-cost report triggers questions about the auditor, causes deals to stall, or must be redone, the total cost exceeds a properly scoped audit. Compare the fee difference against the value of the deals the report must support.

Is it a problem if my auditor partners with my compliance platform?

A partnership is not automatically a problem, but it requires scrutiny. AICPA ethics staff warned in April 2026 that business arrangements with SOC tool providers can threaten independence and objectivity, particularly bundled pricing, platform-set fees, referral arrangements, and platform involvement in the exam. Ask your auditor to disclose any arrangement in writing.

What did the AICPA change about SOC 2 audits in 2026?

In 2026 the AICPA did not change the SOC 2 criteria in force, but it increased oversight. A May 2026 Peer Review Board alert told reviewers that SOC 2 engagements with identical risk assessments, sample sizes, and testing procedures across clients may be nonconforming, and a structured monitoring process began June 1, 2026. Separately, ethics staff issued guidance on business arrangements with SOC tool providers in April 2026.

Can my SOC 2 auditor also help me become compliant?

Your SOC 2 auditor must stay independent of the controls it tests. Designing your controls, writing your policies, or drafting your system description and then auditing them creates a self-review threat. Most companies use a separate readiness provider or internal team for preparation and a separate CPA firm for the examination.

How long should a SOC 2 audit take?

A SOC 2 Type 1 can be completed in weeks once controls are in place. A SOC 2 Type 2 requires an observation period, commonly 3 to 12 months, followed by fieldwork and reporting. Be cautious of any firm that promises a report within days of receiving evidence, since the AICPA has flagged unreasonable engagement timelines as a quality risk.

---