Glossary · SOC and attestation
Only a licensed CPA firm can play the service auditor's part.
The independent CPA practitioner engaged by a service organization to examine its controls and issue the SOC 1, SOC 2 or SOC 3 report.
Back to the glossary01 · In plain words
In plain words
The independent CPA practitioner engaged by a service organization to examine its controls and issue the SOC 1, SOC 2 or SOC 3 report.
In a SOC engagement there are two sides. The company runs the controls; the service auditor checks them and writes the opinion. The service auditor must be a licensed CPA firm and must be independent of the company.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
The value of a SOC report rests on who signed it. Buyers and their auditors rely on the opinion because a licensed, peer-reviewed CPA firm stands behind it under AICPA standards. Independence is the other half: the firm that designs your controls or writes your policies cannot then examine them. This is why a readiness consultant and the service auditor are separate parties. Choosing the service auditor is one of the few decisions a buyer can see directly, since the firm's name is on the report, so it affects how the report is received.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Section 1 of the report
- The service auditor's opinion, signed with the firm's name, city and date.
- The engagement letter
- Sets out the subject matter, the criteria, the period and the responsibilities of each side.
- Fieldwork and walkthroughs
- The service auditor interviews owners, inspects evidence and picks samples.
- A buyer's vendor review
- Reviewers sometimes check the firm's licence and peer review before relying on the report.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a payments startup asks its adviser to sign
A Bengaluru payments startup has worked with a consultancy to write policies and set up access reviews. Near the end, the founder asks whether the same consultancy could issue the report to save time. It cannot: the consultancy is not a CPA firm, and even a CPA firm that built the controls would lose its independence. The startup instead engages a separate licensed CPA firm as service auditor, and the consultancy helps it prepare for fieldwork without taking part in the examination.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- User auditor
- The user auditor audits the customer's financial statements and reads the SOC 1 report. The service auditor writes it.
- Readiness consultant
- A consultant helps you prepare and design controls. It cannot issue the report or give the opinion.
- Internal auditor
- An internal auditor works for the company. A service auditor must be an outside, independent CPA firm.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Shortlist CPA firms that perform SOC examinations, and ask about licensing and peer review.
- Keep your readiness adviser and your service auditor separate, and document who did what.
- Agree the criteria, scope and period in the engagement letter before fieldwork.
- Ask whether the firm has examined services like yours, so walkthroughs are efficient.
- GuideAuditor independenceThe line between helping you and auditing you.
- GuideWho can sign a SOC 2 report?Only a licensed CPA firm, independent of whoever built your controls.
- GuideChoosing a CPA firm for SOC 2Qualifications, peer review, and the questions worth asking.
Sources: AICPA SSAE 18, AT-C section 105 and AT-C section 320 (service auditor responsibilities); AICPA Code of Professional Conduct, independence rule.
Questions about Service auditor
Does Auditify act as the service auditor?
No.
Auditify prepares companies for SOC examinations, tests controls and advises. A licensed CPA firm issues the report. Keeping the roles apart protects the independence that makes the report useful.
Can a firm outside the United States be the service auditor?
It depends on licensing and affiliation.
SOC reports are issued under AICPA standards, so the firm needs the right CPA licensing or affiliation. Some firms outside the US work through licensed affiliates. Ask the firm to show how it is permitted to sign.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.