Licensing across borders
Can a firm outside the United States issue a SOC 2 report?
SOC 2 is built on AICPA attestation standards, and US buyers generally expect the report to be signed by a US-licensed CPA firm. That doesn't keep teams in India or elsewhere out of the work. It shapes who signs and how local professionals take part. This page sets out the framework cautiously; licensing rules change, so confirm the current position before relying on it.
Back to SOC 2 services01 · The framework
The licensing framework behind a SOC 2
The standards come from the AICPA; the right to practise comes from US state boards.
A SOC 2 is an examination engagement performed under the AICPA's Statements on Standards for Attestation Engagements, mainly AT-C 105 and AT-C 205, with the AICPA SOC 2 guide on top. Two separate things stand behind the report: the standards used, and the licence of the firm that signs.
- The standards
- The AICPA's attestation standards bind its members and any practitioner who says an engagement was performed under those standards.
- The licence
- In the US, attest services are regulated by state boards of accountancy, which generally restrict them to firms holding a CPA firm permit.
- The firm
- State rules commonly require a CPA firm to be majority-owned by licensed CPAs and to be enrolled in peer review.
Because the opinion is the firm's, the question is never only “is this person qualified?” It is “is the signing firm licensed and peer-reviewed for attest work?”
02 · CA and CPA
How a Chartered Accountant in India differs from a US CPA
Both are serious qualifications. They grant the right to practise in different jurisdictions.
Chartered Accountant (India)
- Member of the Institute of Chartered Accountants of India (ICAI)
- Performs assurance under ICAI standards, broadly aligned with the international ones
- Licensed to practise in India
Certified Public Accountant (US)
- Licensed by a US state board of accountancy
- Performs attest work under AICPA standards
- Practises through a firm holding a state firm permit
Some foreign accounting bodies have recognition routes into US licensure. Whether one exists for a given qualification, and on what terms, is a question to put to NASBA or the relevant state board.
An Indian firm can perform a genuine assurance engagement over the same Trust Services Criteria under international or ICAI standards. That can be valuable, but it is a different report. It shouldn't be presented as an AICPA SOC 2, and US buyers asking for a SOC 2 may not accept it in place of one.
03 · How teams take part
The ways non-US professionals take part
Local people often do much of the fieldwork. A licensed firm signs.
- Model AA US-licensed firm with international staffThe firm holds the permit and signs. Staff in India or elsewhere carry out work under its supervision and quality system.
- Model BAn affiliation or networkA non-US firm belongs to a network with a US member firm. The US member, holding the permit, issues and signs the report.
- Model CA US firm using local fieldworkAn independent US CPA firm engages local professionals for parts of the work, remains responsible for it, and signs in its own name.
The test that holds across all three
Whoever does the fieldwork, the signature block should name a firm you can find in a US state board licence search and the AICPA peer review public file.
04 · Buyer expectations
What buyers expect from the signing firm
Most reviewers check who signed before they read anything else.
- A firm, named. The report is signed by a firm, with a city and state.
- Licence found. The firm appears in a state board search with an active permit.
- Peer review found. The firm's peer review is accessible and recent.
- AICPA standards stated. The opinion says it was performed under AICPA attestation standards.
- Independence. The firm didn't build or run the controls it examined.
Please confirm current rules with the AICPA, NASBA, the relevant state board and your examiner. This page is general information about how the framework is commonly understood. It is not legal or regulatory advice, and licensing and mobility rules change.
Sources: AICPA SSAE, AT-C sections 105 and 205; AICPA guide SOC 2 Reporting on an Examination of Controls at a Service Organization; AICPA and NASBA Uniform Accountancy Act; AICPA peer review standards; Chartered Accountants Act, 1949; ICAI Standards on Assurance Engagements; IAASB ISAE 3000 (Revised).
More about firms outside the US
Can an Indian CA firm sign our SOC 2 on its own?
Generally not as an AICPA SOC 2. Confirm with the AICPA and your examiner.
As commonly understood, an AICPA SOC 2 is signed by a US-licensed CPA firm. An Indian firm may take part in the work, or issue a different assurance report under its own standards. Confirm the current position before you commit.
Does an Indian firm with a US affiliate change the answer?
It can, if the US member signs.
What matters is the signature. If the affiliated US firm holds the permit and signs, the report can be a SOC 2. Ask exactly which entity will sign, before engagement.
Is an ISAE 3000 report worthless to US buyers?
Not worthless, but not a SOC 2.
Some buyers accept it as strong evidence; others ask specifically for a SOC 2. Check what your key customers will accept before choosing.
Does where our engineers sit affect who can sign?
No. Licensing is about the examiner, not your team.
Your team can be anywhere. The rules discussed here are about the firm that examines you and signs the opinion.
Get the signature question right first.
We help teams outside the US shortlist examiners and confirm who will sign, before readiness work begins.