Changing SOC 2 auditors: when it makes sense and what it costs
Switch between periods, never during fieldwork. Line the new firm's period up against the end of the old report so coverage is continuous, give them your last report and system description, and budget for a first-year fee that is higher than a renewal.
Companies change SOC 2 auditors more often than the firms would like to admit, and usually for good reasons: a fee that rose without a change in scope, a report delivered months late, a team that changed every year, or a customer that wants a firm it recognises. Changing is not a red flag to buyers. A gap in coverage is. This page is about switching without one.
When does changing SOC 2 auditors make sense?
Switch when the problem is the firm, not the audit. The difference matters, because a new firm will find the same control gaps the old one did.
| Reason | Does switching help? |
|---|---|
| Report delivered weeks or months after the agreed date, more than once | Yes. Delivery reliability varies a great deal between firms. |
| Renewal fee rose without any change in scope | Often. Get two quotes and the incumbent may move. |
| A different team every year, relearning your system | Yes, if the new firm commits named staff in writing. |
| A key customer asks for a firm with a recognised name | Yes, though it usually costs more. |
| Exceptions you disagree with | Rarely. Exceptions follow the control, not the firm. |
| A qualified opinion | No. Fix the controls first; a new firm reads the old report. |
If the trouble is how the engagement is being run rather than who runs it, managing your SOC 2 auditor covers the scope memo, the request list and the escalation route that fix most of it without switching.
How do you time a switch so there is no coverage gap?
Buyers care about continuous coverage: a Type 2 report whose period ends where the next one begins. The switch should happen at a period boundary.
- Let the current firm finish the current period's report. Leaving mid-fieldwork means paying for work you then throw away.
- Engage the new firm before the next period starts, so the period can begin the day after the last one ended.
- If the new firm cannot start the period on time, the gap is bridged with a bridge letter from management covering the months between reports.
- Tell your largest customers in advance, with the new firm's name and the expected report date. Nobody objects to a planned change.
Can you switch in the middle of an audit?
You can terminate an engagement letter, but the new firm cannot rely on the old firm's fieldwork and will test the period again. In practice a mid-audit switch only makes sense when the incumbent cannot deliver at all, and even then it usually means a shorter first period with the new firm rather than rescuing the old one.
What does the new audit firm need from you?
- The last SOC 2 report
- Including the exceptions and management's responses. The new firm will look at how they were addressed.
- Your current system description
- Updated for anything that changed since the last report. This is the document they will test.
- The control matrix and evidence inventory
- What you test, how often and where the evidence lives.
- Subservice organisation reports
- Your cloud provider's and key vendors' SOC 2 reports, with your reviews.
- Prior auditor communication, if any
- Firms sometimes ask whether there were disagreements with the previous auditor. Answer honestly; it is an ordinary question.
What does changing SOC 2 auditors cost?
Expect the first year with a new firm to cost more than a renewal with the old one, because the new firm has to understand your system from scratch. The uplift is usually modest for a small company with a clean report and a current description, and larger when the documentation is thin.
| Item | Typical range (CAD) |
|---|---|
| Type 2 renewal with the incumbent | $15,000 to $28,000 |
| Type 2, first year with a new firm | $20,000 to $35,000 |
| Internal time to onboard the new firm | 20 to 40 hours |
A new firm usually prices you as a first-year Type 2. These are the examination fee ranges from SOC 2 audit cost, which has the bands for larger companies and the drivers in detail. Two quotes from firms that know your stage are worth more than any table; why audit quotes differ explains how to read them side by side.
How do you choose the next firm?
Ask the questions the last firm failed. If delivery was the problem, ask for named staff and the report date in the engagement letter. If the fee was the problem, ask for the change order rate in writing. The full list is on questions to ask a SOC 2 auditor, and the directory lists Canadian CPA firms by city.
Common questions
Do customers care if we change SOC 2 auditors?
Rarely, as long as coverage is continuous and the new firm is a licensed CPA firm. What customers notice is a gap between report periods or a report that arrives late, both of which a well-timed switch avoids.
Can the new auditor use the old auditor's work?
No. Each firm forms its own opinion on its own testing of its own period. The new firm will read the previous report for context but will not rely on the previous firm's fieldwork.
Will a new auditor find new exceptions?
It can happen, because a fresh team reads your description and samples with no history. That is a reason to update the description before the period starts, not a reason to stay with a firm that is not working.
How much notice should we give the current firm?
Whatever the engagement letter says, and in practice before they start planning the next period. Firms schedule months ahead, so telling them early is a courtesy that keeps the door open if you want them back.
Can our readiness consultant become our auditor?
No. The independence rules stop the firm that helped design your controls from attesting to them. Can one firm do readiness and the audit covers the detail.
Get quotes from audit firms for your next period
Describe your scope once and compare Canadian CPA firms.
Get matched