How to choose a SOC 2 auditor: questions to ask

Who this is for

This guide is for founders, CTOs, IT leads, security managers and finance or operations staff who are hiring an independent CPA firm to perform a SOC 2 examination. You may be preparing your first report or replacing a firm that missed dates or issued a report your customers questioned.

The auditor you pick shapes the questions your customers ask, the evidence your team collects and the pace of the project. A low fee is not useful if the report arrives late, leaves out a criterion your buyers need, or contains exceptions you did not understand until the draft.

Use this checklist as an interview script. Send it before the call, ask for written answers and compare responses side by side. The goal is not to find the friendliest salesperson. It is to find a firm that can test your controls, explain its findings and produce a report your customers can rely on.

Before you begin

Write down what your customers require before you talk to auditors. Note the report type, the Trust Services Criteria, the review period and whether buyers expect a Type I or Type II report. If a large customer sent a security questionnaire, pull the exact SOC 2 request from it.

Define the system in scope in plain terms: the product, the infrastructure, the people and the supporting services that deliver it. List subservice organizations, such as hosting, identity or support tools, and decide whether you expect a carve-out or inclusive method. Auditors will ask this early because it changes the work.

Prepare a short information pack: your system description draft, control list, policy index, list of key vendors and target audit dates. You do not need a perfect data room at this stage. You do need enough detail for the auditor to size the engagement and name the team.

Build a shortlist of independent CPA firms that perform SOC 2 examinations. Avoid a long beauty parade. Three to five firms is enough to compare approach, team and terms without turning the search into a second job.

The checklist

Ask every firm the same questions and keep the answers. A good auditor will welcome a specific conversation about scope, timing and exceptions. A vague answer now often becomes a vague engagement letter later.

Focus on how the firm works, not only on its brand. You want to know who will test your controls, how they sample evidence, how they report problems and what happens when your period changes.

• Are you an independent CPA firm, and who will sign the SOC 2 report?
• Can you show a redacted sample SOC 2 report that your firm issued, including the system description, control tests and results?
• Which Trust Services Criteria do you recommend for our scope, and why?
• How do you treat subservice organizations, and do you expect a carve-out or inclusive method for our vendors?
• Who performs fieldwork, who reviews the work, and will those people be available during our audit window?
• What does your evidence request list look like, and when can we see it before fieldwork starts?
• How do you select samples, and what happens if a control has no evidence for part of the period?
• How do you report exceptions, and will management responses appear in the report?
• What is your process for reviewing the draft report, and how many rounds of comments are included?
• Do you issue a bridge letter after the report date, and what do you need from us to issue one?
• What are your fee structure, billing milestones and assumptions about out-of-scope work?
• What happens if we change the audit period, add a criterion or delay fieldwork?
• Can you explain how you keep independence if we also buy readiness help from your firm?
• What do you need from our leadership team, and when do you need it?

What good looks like

A good auditor answers scope questions with trade-offs, not slogans. They will tell you that adding Availability or Confidentiality increases testing, that an inclusive method pulls vendor controls into your report, and that a Type I report covers a point in time while a Type II covers a period.

They name the engagement team and the reviewer. They give you a sample report so you can see how they write the system description and how they present exceptions. They provide an evidence request list early enough for you to fix gaps before fieldwork.

They put key terms in the engagement letter: scope, criteria, period, report type, responsibilities, fees, billing schedule, draft review and what happens if the scope changes. They do not promise a clean opinion before testing. They explain that the report includes management's assertion and the auditor's opinion, and that you must not edit it after issue.

Watch for warning signs: pressure to skip a readiness step, unclear ownership of the report, no sample report, a rotating team, or answers that avoid the word exception. Also check that the firm can meet your deadline without promising work it cannot staff.

What to do next

Score the answers against your customer requirements, not against the sales pitch. Rank each firm on report fit, team experience, evidence process, schedule, independence and clarity of terms. Call the two strongest firms back with the same follow-up questions.

Ask for the engagement letter before you choose. Read the scope, period, criteria, fee schedule and change clauses. Confirm who signs, who reviews, when fieldwork starts and when you get the draft. If the letter is vague, ask for a revised version.

Then run a short readiness pass before the audit begins. Fix missing policies, close evidence gaps and assign owners for each control. A few weeks of cleanup can save a painful round of exceptions.

If you need help before you send the request, Cloudverg's SOC 2 readiness assessment is a fixed price package at $7,500 that runs three weeks and starts within 10 business days. It includes scoping of systems, criteria and report type, a gap assessment against the Trust Services Criteria, a policy and evidence inventory, a remediation roadmap, a shortlist of independent CPA firms and a 60-minute leadership readout. It is one option among others, and it does not replace the independent audit.

Frequently asked questions