SOC 2 guide
SOC 2 cost: what moves the price of readiness and of the examination
A SOC 2 report is paid for twice: readiness, which gets controls designed, operating and evidenced, and the examination, priced by a licensed CPA firm. Here are the eight drivers behind both, the costs that surface late and how to compare CPA firm proposals.
Key points
- SOC 2 arrives as two invoices: readiness, which gets your controls operating and producing evidence, and the examination, which a licensed CPA firm prices from the system, the criteria in scope, the period and the report type.
- Eight drivers move one invoice or both: Trust Services categories, system boundary, headcount and locations, control maturity, report sequence, period length, evidence tooling and subservice organisations.
- No standard fixes the hours of a SOC 2 examination, so proposals for one scope can differ widely; compare peer review, SOC experience, sampling and timeline before fees.
- Overruns usually come from report re-issues, gaps between periods, tools nobody uses and exceptions that force remediation mid-period.
Two invoices: readiness and the examination
A SOC 2 budget has two main lines, best kept with two separate firms. Readiness pays for bringing your controls to a state a CPA firm can test: scoping the system and categories, the gap analysis, control design and remediation, the policies and the system description, training for control owners, and the months of operation that generate evidence. The examination pays a licensed CPA firm, or an equivalent practitioner reporting under ISAE 3000 outside the United States, to test those controls and give its opinion.
The CPA firm sets its own fee. No attestation standard prescribes how many hours an examination takes, so each firm estimates them from four inputs: the system and locations in scope, the criteria your categories bring, the period and the report type. A Type 1 examines the description and the design of the controls at one date; a Type 2 adds tests of operating effectiveness across a period, hence more sampling, longer fieldwork and a larger fee.
Your own people carry a third, uninvoiced cost: running controls, answering evidence requests and reviewing the description and the draft report.
Eight drivers, and which invoice each one moves
Some drivers mainly change readiness, some mainly change the examination, and several change both.
| Driver | Readiness effort | Examination effort |
|---|---|---|
| Trust Services categories in scope | Security is always in; each added category brings its own criteria, controls and evidence, privacy the widest set | More criteria to examine, more controls to test and report on |
| System boundary: products and environments | Every product, environment or cloud account inside the boundary needs access, change, monitoring and backup controls, and a place in the description | More populations and walkthroughs; environments managed differently are usually sampled separately |
| Headcount and locations | More joiners, leavers, screening, training and access reviews; each office in scope adds physical access controls | Larger populations, though samples do not grow in proportion; any site visit adds time and travel |
| Control maturity and existing certifications | Usually the biggest swing: working controls with dated records are mapped, not rebuilt, and an ISO/IEC 27001 management system supplies much of the groundwork | Testing barely changes, because the firm tests your controls itself; the gain is fewer exceptions and quicker fieldwork |
| Type 1 then Type 2, or Type 2 only | Similar work either way; the Type 1 route adds a second round of description drafting and evidence requests | Two engagements and two fees; Type 2 only saves one fee but delays the first report |
| Length of the examination period | Each added month is another month of evidence to produce, review and keep | Samples grow more slowly than the calendar; long periods may be tested in interim and final visits |
| Evidence tooling | A platform that schedules controls and keeps dated records cuts collection time; spreadsheets move that time onto your people | Faster answers to requests shorten fieldwork; the firm still chooses the samples and checks that exported reports are complete |
| Subservice organisations | Under the carve-out method you monitor each provider, reviewing its SOC report and operating the controls it expects of customers | Carve-out leaves the provider's controls outside the examination; the inclusive method brings them in, with the provider's cooperation and more fieldwork |
The drivers compound, so scope is the largest cost decision: examine the service your customers' contracts name, with the categories they ask for, and extend in a later period.
What does not change the price
- Urgency. A Type 2 reports on months that must pass first, and no fee shortens them; one offered within weeks from a standing start will not satisfy your customers' security teams.
- A certificate you already hold. ISO/IEC 27001 shortens readiness, not the examination: the CPA firm tests your controls itself and does not accept another body's certificate as evidence that a control operated during the period.
- Your choice of consultant. The firm plans its testing from your system and controls; a consultant changes how prepared you are, not how much there is to test.
- The size of the policy library. More documents do not shorten fieldwork; each one is another statement the evidence must match.
- How widely you share the report. Giving it to more customers and prospects under non-disclosure agreements adds nothing to the fee.
How to compare CPA firm proposals
First confirm that every proposal prices the same system, categories, period and report type; a lower figure often covers less.
Licence and AICPA peer review
Which licensed CPA firm signs the report? Peer review is the profession's check on a firm: another practitioner reviews selected engagements or the firm's system of quality control. Ask for the latest peer review report, its conclusion and whether SOC examinations were among the engagements selected. Outside the United States, ask an ISAE 3000 practitioner for equivalent evidence of external inspection.
SOC experience
How many SOC 2 examinations has the engagement lead signed for organisations like yours, on your cloud platforms? Who does the fieldwork, and will the same team return next year?
Sampling approach
How are sample sizes set for daily, weekly, quarterly and annual controls? How are automated controls tested, and how are reports exported from your systems checked for completeness? Are exceptions raised during fieldwork, or first seen in the draft report?
Timeline and exclusions
When does fieldwork start after the period closes, and when does the signed report arrive? Are the Type 1, a SOC 3, travel, re-issues and the renewal priced or left open? If the same firm offers to design your controls, ask how its independence will be protected; your customers' reviewers will.
The Sterling model: fixed scope and one all-inclusive proposal
Sterling prices the readiness side only, against a written scope: the system, categories, locations, report sequence and period your customers need. You engage the CPA firm directly, so its fee never disappears into ours.
How Sterling prices SOC 2 readiness
Readiness priced once, in writing, and tested before the CPA firm arrives.
We fix the fee for Design™ or Drive™ against named deliverables, responsibilities, assumptions and exclusions, so it does not grow with the hours. Effivity holds the control set, the evidence calendar and every dated record, included with the engagement, at no additional cost. Alongside the consulting come preferential Sterling Academy course access and special pricing, including complimentary awareness training for your people as part of the engagement. Our readiness assessment samples every control before the period opens, our consultants stay with your team through fieldwork, and Sustain™ carries the evidence calendar into the next period. Sterling does not issue the report; we deliver the readiness, and the opinion comes only from the independent, licensed CPA firm you engage.
Book a free discovery callSOC 2 cost: questions buyers ask
Why do CPA firm quotations for the same scope differ so much?
Each firm estimates hours by its own method, and staffing, travel and inclusions vary. A figure well below the rest usually prices less work, such as a shorter period, fewer locations or no SOC 3; ask every firm to list its exclusions in writing.
Does the second year cost less than the first?
On the readiness side, usually: the controls, the description and the evidence calendar exist, and any Type 1 is behind you. The examination shrinks less, because every period is examined in full. Under Sustain™ the second year is upkeep, not a rebuild.
Can we add a Trust Services category in a later year?
Yes, and it spreads the cost. The new category's controls must be operating before that period opens, since a Type 2 covers the whole period, and the CPA firm prices the added criteria into its renewal proposal.
Is a SOC 3 report an extra cost?
Usually, as a separate line in the CPA firm's proposal. A SOC 3 is a short general-use report, drawn from the same Type 2 examination, that you can publish; it does not replace the SOC 2 for customers who want the tests and their results.
We also need a SOC 1. Can the two examinations share the cost?
Partly. The reports and opinions stay separate, since SOC 1 addresses controls relevant to your clients' financial reporting. When one firm examines both over the same period, walkthroughs and tests of shared IT general controls can serve both, and one control set in Effivity supports readiness for each.
More SOC 2 guides
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 bridge letters, report validity and the annual cycle
- Choosing a SOC 2 service auditor
- SOC 2 common mistakes
- SOC 2 continuous monitoring
- SOC 2 cost: what moves the price
- Decision guide
- Effivity for SOC 2: the guide
- SOC 2 exceptions and qualified opinions
- SOC 2 policies and evidence: what you need and what you do not
- The SOC 2 system description: what to write and what to leave out
- SOC 2 Trust Services Criteria explained, criterion by criterion
- SOC 2 Type 1 vs Type 2: which report, and when
- SOC 2 vs ISO/IEC 27001: which one, or both?
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice