How to choose a SOC 2 auditor
The SOC 2 auditor you pick will shape three months of your team's life and produce a report your customers will read for the next year. It is one of the highest-leverage vendor decisions a growing company makes, and most founders pick based on whoever responded fastest to a cold email.
Here is how to do it properly.
This is non-negotiable and frequently misunderstood. SOC 2 reports can only be issued by a licensed Certified Public Accountant firm in good standing with the AICPA. Not a consultant. Not a security firm. Not a former Big Four auditor working solo without a firm license.
If a vendor offers to "do your SOC 2" without being a CPA firm, what they are actually offering is readiness or advisory work. They cannot sign the report. You will still need a real auditor at the end, and the work product from a non-CPA may not be useful to that auditor.
Verify the license. Every state CPA board has a public lookup. Ask for the firm's PCAOB or AICPA registration if you want extra assurance.
A SOC 2 audit at a 25-person startup is fundamentally different from a SOC 2 audit at a 5,000-person enterprise. The control environments, the evidence, the tooling, and the risk profile all look different.
A Big Four firm doing your audit will charge a premium and assign you the most junior people on their roster, who may have spent the prior year auditing a regional bank. They are competent, but they will ask for evidence that does not apply (like change advisory board records when your team is six engineers shipping continuously) and miss the things that do.
A boutique firm that does 80 percent startup work will know what good looks like for a company your size. They will accept GitHub branch protection logs as change management evidence without a fight. They will not insist on a separate development environment for compliance theater.
Ask any prospective auditor: "How many SOC 2 audits did your firm complete last year for companies with under 100 employees?" If the answer is fewer than ten, they are not your auditor.
Some auditors quote a fixed fee for the entire engagement. Others quote an hourly rate with an estimate. Always pick the fixed fee if both are options.
Time-and-materials creates a perverse incentive. The auditor benefits from asking more questions, requesting more evidence, and dragging out fieldwork. Fixed-fee aligns incentives. The auditor wants to finish efficiently because their margin depends on it.
Reasonable fixed-fee ranges in 2026 for a small SaaS company:
- Type I: $7,000 to $15,000
- Type II: $15,000 to $30,000
If a quote comes in significantly below those ranges, ask why. Sometimes it is a firm building a startup practice. Sometimes it is a sign that the work will be cursory and the report will not be respected by your customers' procurement teams.
If a quote comes in significantly above, you are probably looking at a Big Four or large regional firm. Ask whether their report carries enough weight with your specific customers to justify the premium. For most early-stage SaaS, it does not.
CPA firms are subject to peer review. Two systems exist:
- AICPA peer review program: every three years, another CPA firm reviews the firm's work product. This applies to most firms doing SOC 2 work for private companies.
- PCAOB inspections: applies to firms that audit public companies. More rigorous, more frequent, and signals a higher-tier firm.
For a private SaaS company, AICPA peer review is sufficient. Ask for the most recent peer review report. A "pass" rating is what you want. "Pass with deficiencies" is acceptable if the deficiencies are unrelated to SOC 2 work. "Fail" should disqualify the firm.
Firms hide bad peer reviews. If they refuse to share, walk away.
You will be in weekly meetings with your audit team for two to three months. Their responsiveness, their tone, and their willingness to explain things will dictate how miserable that period is.
Before signing, do a working session. Most reputable auditors will agree to a one-hour scoping call with their actual audit team, not just the partner doing sales. Pay attention to:
- Do they ask about your business, or just rattle off control language?
- Do they explain why an evidence type matters, or just demand it?
- How long do they take to respond to email during the proposal phase? (This is your best preview of how they will respond during fieldwork.)
- Are they willing to use modern evidence types like API exports and SaaS integrations, or do they insist on screenshots?
If the partner is great but the manager who will actually run your audit is hard to reach, the audit will be hard to reach. The manager is who matters.
Three questions to ask any auditor before signing
-
"What percentage of your SOC 2 clients are SaaS companies under 100 employees?" Looking for: 50 percent or higher.
-
"Can I see your most recent peer review report?" Looking for: a pass rating, shared without resistance.
-
"Will you accept evidence from compliance automation platforms, or do you require screenshots?" Looking for: yes to automation. If they insist on screenshots in 2026, they have not modernized their practice.
What happens after you choose
Once you have signed the engagement letter, the next step is scoping. The auditor will define the trust services criteria in scope (security is mandatory; availability, confidentiality, processing integrity, and privacy are optional), the systems in scope, and the audit period.
For a realistic view of how long the whole thing takes, see the SOC 2 timeline guide. And if you want your evidence in order before fieldwork starts, book a call to have a fractional CISO get you audit-ready.
Related reading
- SOC 2 Type 1 vs Type 2: which do you need?
- SOC 2 Trust Service Criteria explained
- SOC 2 scope definition guide
- How long does SOC 2 take?
Want a security leader to run this?
Xorabyte is a fractional CISO for startups who can own your SOC 2 readiness end to end, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.