Choosing a SOC 2 service auditor: what to ask a CPA firm before you sign

Who can issue a SOC 2 report

The first question is whether the firm may sign a SOC 2 opinion at all. A SOC 2 examination is an attestation engagement performed under the standards of the American Institute of Certified Public Accountants. Only a licensed CPA firm can perform it and put its name to the opinion. The firm is the service auditor; your organisation is the service organisation; your clients are the report users who rely on the result.

Compliance platforms, consultancies and security firms often sell packages close to the examination without being entitled to perform it. Read the proposal for the legal entity that will sign the report. If it is not a licensed CPA firm, the document is not a SOC 2 report, and a client security team will say so.

Outside the United States, ask which entity signs and under which standard, since some firms report through a licensed US affiliate and others under ISAE 3000, and confirm your clients accept that form of report.

How to check a CPA firm's licence and peer review

Two public checks settle most doubts, and neither needs the firm's cooperation.

The licence

CPA firms are licensed or registered by state boards of accountancy. Each board keeps its own register, and CPAverify, a national lookup populated with official data from the boards of accountancy, lets you search firms and individual CPAs in one place. Look for an active status and any enforcement actions, and where a board does not feed the national lookup, search its own site. Ask the firm for its licence number and issuing state in writing and match them yourself.

The peer review

Firms that perform attest work, which includes SOC examinations, are required to take part in the AICPA peer review programme, with a review every three years. Each review ends in one of three ratings: pass, pass with deficiencies, or fail. Many reports are available through the AICPA's Peer Review Public File, which also shows enrolment and review dates. Ask for the latest peer review report and letter of response. A firm that cannot show a recent pass, or explains a deficiency without evidence of remediation, is one to question closely.

Independence: why the examiner cannot be your implementer

A SOC 2 opinion is valuable because someone with no stake in your controls has tested them. Independence rules for CPA firms restrict a firm from examining work it designed, built or runs for you, since it would be testing itself. If it emerges that one firm wrote the policies, configured the tools and issued the opinion, the report loses credibility with the very readers it was meant to reassure.

That is why Sterling's role and the service auditor's role stay apart. Sterling's expert and experienced consultants carry out the gap analysis, help your team design and document the controls, set up the evidence calendar in Effivity and test readiness before the examination period begins. The CPA firm you appoint then examines the controls independently and issues its opinion. Sterling does not issue the report and does not examine for the CPA firm. Where one provider offers both, ask how independence is met and get the answer in the engagement letter.

What a service auditor's proposal should state

A complete proposal sets out the following, not just a fee and a date.

• Report type. Type 1 (design as at a date), Type 2 (design and operating effectiveness over a period), or a Type 1 followed by a Type 2. The choice itself is covered in the Type 1 vs Type 2 guide.
• Criteria and categories. Security in every case, and which of availability, processing integrity, confidentiality and privacy are in scope, matching the system you defined.
• The system and the subservice organisations. The services, infrastructure and locations examined, and whether cloud or other providers are treated by the carve-out or the inclusive method.
• Examination period. Start and end dates for a Type 2, and the reasoning for the length proposed.
• Testing approach. How the firm will sample and test (inspection, observation, inquiry, re-performance), including system-generated reports.
• Fieldwork. Dates, remote or on-site, the team's seniority and the evidence request process.
• Deliverable timing. When the draft and final report follow fieldwork.
• Bridge letters and renewal. Whether the firm supports the bridge letter you will issue between reports and how the next period is scheduled, which the bridge letters and annual cycle guide explains.

Fieldwork and sampling are covered in the SOC 2 examination guide.

Questions to ask before you sign

A short call with each shortlisted firm tells you more than a brochure.

1. Which licensed entity will sign the report, and in which state is it licensed?
2. When was your last peer review, what was the rating, and may we see the report?
3. How many SOC 2 examinations has the proposed team led for organisations in our sector and on our cloud platform?
4. How do you treat our cloud provider and other subservice organisations, and which complementary controls will you expect from us?
5. How will you communicate exceptions during fieldwork, and how much time do we have to respond before the report is drafted?
6. How do you maintain independence from any consultancy or software vendor we use?

Sector experience deserves weight: a firm that has examined payroll processors understands processing integrity, and one that has examined data centres understands physical controls.

Comparing three proposals side by side

Three illustrative proposals for the same Type 2 request, fees left out, show what matters before price does.

Warning signs in a service auditor proposal

• A report promised in days. A Type 2 covers controls operating over a period; months cannot be compressed into a week.
• No testing of operating effectiveness in a Type 2. A review of policies or screenshots will not satisfy a client who reads the testing section.
• No named CPA firm. A provider that will not name the signing firm before you pay is asking for trust you should not give.
• An opinion guaranteed in advance. A service auditor cannot promise an unqualified opinion before testing; exceptions are found by examination, not negotiated beforehand.
• The same firm building and examining. Implementation and examination bundled together should prompt a direct question about independence.

If a report has already been issued and you want to judge it, the guide to reading a SOC 2 report covers the opinion and exceptions.

Choosing a SOC 2 service auditor: questions buyers ask