The SOC 2 auditor
The signature on a SOC 2 opinion, and the three tests behind it.
Turn to the end of the independent service auditor's report in any SOC 2 and you find a firm's name, a place and a date. That signature carries the value of the whole document. Buyers trust it because the signer holds a CPA licence, has had its own work peer reviewed, and stood independent of the company it examined. Anyone who fails one of those tests can help you prepare. They cannot put their name there.
Back to SOC 2 services01 · The signature block
What the last lines of the opinion tell a reader
A few lines of text hold the report's authority.
A SOC 2 report has several authors. Management writes the system description and signs the assertion. The service auditor writes the opinion and, in a Type 2, the tests and their results. Only the opinion carries a signature, and a buyer's security team will look at it. It goes out in the firm's name, not under one person's credential.
| What you see | What it should tell you | If it is missing |
|---|---|---|
| Firm name | The practice that took responsibility for the opinion | Ask who issued the report. A person's name alone is not enough |
| City and state | Where the firm practises, normally a US state | Treat the report as unverified until you have looked the firm up |
| Report date | When the auditor finished gathering evidence, commonly some weeks after the period closes | You cannot judge how fresh the opinion is |
| Standards named | That the work followed the AICPA attestation standards for examinations | A report citing no standard is not a SOC 2 in the AICPA sense |
Credentials such as CISA or CISSP on the engagement team add skill to the fieldwork. They add no authority: no personal certification lets someone sign a SOC 2 opinion on their own account.
02 · Three tests
Licence, peer review, independence
Each test answers a different doubt a buyer has about the signer.
- Test 1Licensed to practise public accountingSOC 2 is an examination engagement. AT-C 105 sets the concepts every attestation shares and AT-C 205 governs examinations. State boards of accountancy reserve that work for licensed CPA firms.
- Test 2Its own quality has been inspectedFirms doing attest work enrol in peer review. Every few years another firm inspects a selection of their engagements and reports on whether their quality system holds up.
- Test 3No stake in what it examinedUnder the AICPA Code of Professional Conduct, a firm that took on management's responsibilities for your controls has lost its independence from them, so it cannot examine them.
The tests stack rather than substitute. A licensed firm with a lapsed peer review gives your buyer's reviewers a reason to pause. A peer-reviewed firm that also designed your access reviews puts the opinion itself in doubt.
Nobody signs a certificate
The deliverable is an opinion, so no one is licensed to award a SOC 2 certificate. A vendor selling SOC 2 certification with no CPA firm's opinion attached is selling something else under a borrowed name.
03 · Who does what
Everyone around the report, and whether they can sign
Many parties shape a SOC 2. One signs it.
| Party | What it contributes | Signs the opinion? |
|---|---|---|
| Your management | Owns the controls, writes the description, signs the assertion | No. Its signature goes on the assertion, a separate statement |
| Readiness adviser, such as Auditify | Gap assessment, control design support, evidence habits | No. Helping build the controls rules that out |
| Compliance automation platform | Connects to your tools, gathers evidence, tracks tasks | No. Software cannot attest |
| Penetration tester | Tests the system; its report becomes evidence | No |
| Chartered accountant or other non-US accountant | May be skilled at assurance under national or international standards | Not for a SOC 2 under AICPA standards, unless a licensed CPA firm issues it |
| Independent licensed CPA firm | Plans the examination, samples evidence, forms the opinion | Yes |
Geography matters only for the signer. Your engineers, evidence and remediation can sit in India or anywhere else. Some CPA firms use affiliates or staff abroad for fieldwork; the question that counts is which licensed firm issues the opinion. An ISAE 3000 assurance report from a practitioner elsewhere can use the Trust Services Criteria too, and some buyers accept it, but it is a different product and should be called one.
04 · The independence line
Why the helper and the examiner are two firms
Otherwise the examiner would be grading its own work.
The AICPA rules on nonattest services let a firm do some other work for an attest client, but not work in which it makes management's decisions or runs management's processes. Designing your control set, operating a control on your behalf or choosing which risks you accept all fall on the wrong side. Readiness and examination therefore go to separate firms, with your management between them making every call.
Fine for the examining firm
- Explaining what a criterion asks for
- Noting a weakness it saw while testing
- Requesting populations and testing samples
Off limits for the examining firm
- Writing your policies and control set
- Running a control, such as the quarterly access review
- Deciding how you respond to a risk
The detailed line, and the safeguards a firm must document, are on the auditor independence page.
05 · Before you engage
Five checks before the engagement letter
Each can be settled from a public record or one direct question.
- Licence lookup. Search the firm on the database of the state board it names. An active firm permit is the floor.
- Peer review result. Ask for the latest peer review report and its rating, then compare it with the AICPA's public record.
- Standards cited. Read a sample report the firm has issued, redacted if need be, and confirm it names the AICPA attestation standards.
- Independence answer. Ask whether the firm or anyone in its network advised on your controls, and how it concluded it is still independent.
- Who reviews offshore fieldwork. If staff outside the US do the testing, confirm which licensed firm reviews that work and issues the report.
Sources: AICPA attestation standards, AT-C section 105 (concepts common to all attestation engagements) and AT-C section 205 (examination engagements); AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization; AICPA Code of Professional Conduct, independence and nonattest services; AICPA Peer Review Program standards.
06 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
Questions about the signer
Can one licensed CPA sign our SOC 2 personally?
The opinion goes out under a firm.
Attest work is performed through a licensed firm. A sole practitioner can run such a firm, but the report still carries the firm's name and needs the firm's own peer review.
Our readiness adviser has a related CPA firm. Can that firm examine us?
Only after a written independence conclusion.
The AICPA rules look at network relationships, not just legal entities. If the adviser made decisions about your controls, a related firm inherits the self-review problem. Ask for the firm's conclusion in writing; your buyers' reviewers may ask too.
What is a compliance platform's “audit partner”?
A CPA firm the platform introduces you to.
Platforms commonly refer customers to CPA firms they work with. The firm still has to pass the three tests on its own, and your engagement letter is with the firm, not the software vendor.
Our report came from an unlicensed firm. Is the work wasted?
The controls stand. The examination does not.
Controls you ran and evidence you kept remain yours. A licensed firm plans its own examination and picks its own samples; it cannot adopt someone else's opinion, so expect it to perform the work afresh for the period it reports on.
Do buyers really check who signed?
Mature security teams do.
Reviewers commonly read the signature block and look up the firm, more so when the name is unfamiliar. Choosing a firm that clears all three tests avoids that conversation in the middle of a deal.
Prepare for the firm that will sign.
Auditify assesses your readiness and helps you build the evidence. An independent licensed CPA firm performs the examination and signs the opinion.