Selecting your examiner
Choosing the CPA firm that will examine your SOC 2.
Every eligible firm is a licensed CPA firm, so eligibility is only the entry ticket. The choice that matters is which firm understands your kind of system, staffs the work with people who can read it, tells you about problems early, and signs a report your buyers will trust. This guide turns that choice into checks you can score.
Back to SOC 2 services01 · Beyond the licence
Eligibility is the floor, not the decision
Confirm the licence and peer review in minutes, then spend your effort on fit.
Our guide to who may sign a SOC 2 covers the rule itself: the opinion comes from a licensed CPA firm that is independent of you. This page starts where that one stops. Two firms can both be eligible and still produce very different experiences and very different reports.
- Firm permit. The firm, not just a partner, holds a firm permit from a US state board of accountancy. Look it up on the board's public search.
- Peer review. The firm's most recent peer review covers attestation work and is accessible in the AICPA's public file. Read the rating and any deficiencies noted.
- Attestation practice. SOC examinations are a regular line of work for the firm, not an occasional add-on to tax or bookkeeping.
A peer review looks at the firm's quality system on a sample of its engagements. It isn't a rating of how good your auditor will be, but a fail or repeated deficiencies are worth a direct question.
02 · Fit with your system
Does the firm understand what it is examining?
An examiner who can't read your architecture tests the paperwork instead.
- Your stackHas the team examined systems on your cloud provider, with your style of deployment pipeline and identity setup?
- Your categoriesIf you need Availability, Processing Integrity or Privacy, has the firm reported on them before, or only on Security?
- Your vendorsIs the firm comfortable with carve-out presentation and with reviewing your subservice reports, or does it treat every vendor as a surprise?
- Your buyersWill the report be read by banks, hospitals or public bodies? A firm used to demanding readers writes descriptions that survive them.
How the engagement is staffed
- Ask who will sign the report and how much of the work that person reviews directly.
- Ask who runs fieldwork day to day, and whether the IT auditors have hands-on technical backgrounds.
- Ask how the firm keeps the same team across years, so year two isn't a fresh introduction.
- Ask where the team works and in which time zone, so walkthroughs fit your engineers' day.
03 · Findings and readiness
How findings reach you, and what the firm does with prior work
The best time to hear about a problem is before it becomes an exception.
Ask the firm to describe how it raises a potential deviation: in a weekly status note, on a shared tracker, or only in the draft report. A firm that flags issues as they arise gives you time to explain context or supply missing evidence. A firm that saves everything for the draft leaves you arguing about wording.
Ask too how it treats readiness work done by others. An independent examiner should welcome a well-organised evidence set and a clear control matrix, while testing everything itself. Be wary of a firm that refuses to engage unless you also buy its own readiness package, or one that seems to accept your consultant's conclusions without testing them.
References worth asking for
Ask to speak with two or three current clients of similar size and stack. Ask them how surprises were handled, whether the draft report needed heavy correction, and whether their own customers ever questioned the report.
04 · Selection scorecard
A scorecard for comparing firms
Score each firm 1 to 3 per row, and weight the rows that matter most to you.
| What you are scoring | Scores 1 | Scores 3 |
|---|---|---|
| Licence and peer review | Unclear permit, or a peer review rating it won't discuss | Permit and peer review found in public records, rating shared openly |
| System fit | No examples on a stack like yours | Can describe how it tests your kind of pipeline and access model |
| Category experience | Security only | Has reported on the extra categories you need |
| Staffing | Signer unnamed, team rotates | Signer named, technical auditors, continuity plan |
| Communication | Issues surface in the draft | Running tracker, issues raised as found |
| Prior readiness work | Insists on its own package, or tests nothing | Uses your evidence set, tests independently |
| References | None offered | Comparable clients willing to talk |
| Proposal clarity | Vague on scope and deliverables | States scope, period, categories, timeline and what is excluded |
What a proposal should state
- The report type and, for a Type 2, the observation period dates.
- The system in scope and the categories included.
- How subservice organizations will be presented.
- The fieldwork approach: remote, on-site, or mixed, and the evidence request process.
- What triggers extra fees or a change in scope.
- Who signs, and the expected date for the draft and final report.
05 · Questions to ask
Questions to put to every firm on your shortlist
Ask them all the same questions, and compare the answers side by side.
- How do you plan the population and sampling for a team of our size?
- What do you need from us in walkthroughs, and who must attend?
- How do you decide whether a deviation becomes a reported exception?
- How do you review the system description, and how many drafts are usual?
- What would make you decline or withdraw from an engagement like ours?
- How do you handle a request for a bridge letter or a question from one of our customers?
The question about declining is the most revealing. A firm that can't name a reason to walk away may not be applying much professional judgement elsewhere either.
06 · Red flags
Offers to walk away from
If it sounds like buying a document, it probably is.
- A report with no examiner contact. No walkthroughs, no questions, no sampling requests. An examination requires the firm to obtain evidence itself.
- A guaranteed clean opinion. No firm can promise an unmodified opinion before it has tested anything.
- The same firm builds and examines. Designing or running your controls and then attesting to them breaks independence.
- A “SOC 2 certificate”. There is no such thing. The deliverable is an examination report with an opinion.
- No firm name in the signature. The report must be signed by a firm. A personal name or a platform logo alone is not enough.
Sources: AICPA Statements on Standards for Attestation Engagements, AT-C sections 105 and 205; AICPA Standards for Performing and Reporting on Peer Reviews; AICPA Code of Professional Conduct (independence); AICPA guide SOC 2 Reporting on an Examination of Controls at a Service Organization.
More about choosing an examiner
Is a bigger firm always the safer choice?
No. Fit and attention matter more than size.
A large firm brings recognition with some buyers; a specialist firm may give a small company more senior attention. Score both on the same rows and let system fit and communication decide.
Should we pick the examiner before readiness work starts?
Early is better, even if fieldwork is later.
Knowing your examiner early lets you agree the period, the categories and the evidence format before you build to them. The examiner still can't design your controls; it can only tell you how it will test them.
Can our compliance platform choose the auditor for us?
It can introduce one. The decision stays yours.
Platforms often have partner firms. That can be convenient, but run the same scorecard. The engagement letter is between you and the firm, and you are the one whose buyers will read the report.
What if we want to change firms later?
You can, as long as the periods still abut.
A new firm plans its own examination and will want to see the prior report and any exceptions. Line up the change so the next period starts the day after the last one ended.
Arrive at the examiner ready.
We prepare your controls, evidence and description so the firm you choose can spend its time testing, not chasing.