Questions to ask a SOC 2 auditor
Most buyers ask three questions: what does it cost, how long does it take, and have you done SaaS. All three have answers that sound the same from every firm. These are the ones that separate them.
Ask fourteen questions, and get the answers to five of them in writing. The five that matter most are who signs the opinion, how many SOC 2 opinions the firm issued last year, whether any fieldwork is subcontracted, what the year two fee will be, and how long it takes from the end of fieldwork to a signed report. Every firm answers the first three questions you were going to ask identically, which is why those three tell you nothing.
Work through these on a first call, once you have decided what category of firm you want and are comparing three of them.
Licensing and who signs
- Is the firm a licensed CPA practice, and in which province?
- A SOC 2 examination is an attestation engagement performed under AICPA standards, and it must be issued by a licensed CPA firm. Canadian provincial CPA bodies licence firms provincially, so ask which body and check it. A consultancy that is not a CPA firm cannot issue the report, no matter what its website says.
- Who signs the opinion, and how many SOC 2 opinions have they personally signed?
- You want a name and a number. It separates a firm with a real practice from a firm with one partner who does this occasionally between tax seasons.
- Is your peer review current, and can we see the most recent report?
- Firms performing attestation work are subject to peer review. A current pass is table stakes, and a firm that hesitates here has told you something worth knowing.
- How many SOC 2 examinations did the firm issue in the last twelve months?
- Under about ten a year and you are paying for a learning curve. The answer to this and the previous question together are more predictive of your experience than anything on the proposal.
How to check the answers
What a good answer includes. The name of the provincial CPA body or US state board the firm is licensed with, the name of the partner who will sign, and a peer review letter you can read. A firm that hesitates on any of these is telling you something.
How to verify. Look the firm up on the licensing body's public register. Canadian CPA practices are registered with their provincial CPA body, and US firms with a state board of accountancy. Peer review results for US firms are public through the AICPA.
Common mistakes. Taking "we are SOC 2 certified auditors" at face value (there is no such certification), and not asking who actually signs, which is often a partner you never meet.
Canadian note. A report from a US-licensed firm is fine for most buyers, including Canadian ones. What matters is that the firm is licensed to issue it and peer reviewed. A few Canadian public sector buyers prefer a Canadian firm; check the buyer's questionnaire before you choose.
Delivery, staffing and timing
- Is any part of the engagement subcontracted, and to whom?
- Some firms subcontract fieldwork offshore and sign the opinion locally. That is not improper on its own, and it changes response times, evidence handling and where your data goes. Ask for it in writing. A firm that will not confirm the answer in writing has answered.
- Who is on the team, and what is the ratio of partner to senior to staff hours?
- Most of your interaction is with the staff and senior level. A proposal priced on partner involvement that arrives with a first-year associate is the most common quiet disappointment in this market.
- What is the earliest fieldwork start date you can commit to?
- Capacity, not competence, is what usually breaks a SOC 2 timeline. National firms schedule further out than boutiques. Get the date before you compare anything else if you have a deadline.
- How long from the end of fieldwork to a signed report?
- Four to six weeks is a good answer. Eight to ten is common and survivable. Anything longer, or a refusal to name a range, should be priced in against your customer's date. The deadline calculator shows what each answer does to your schedule.
- Will you examine a period that has already elapsed?
- Relevant only if your controls have been running with evidence kept. Firms differ, and a yes can put a Type 2 in your hands months earlier. Ask early, because the answer changes the whole plan.
How to check the answers
What a good answer includes. Named people with their roles, the share of hours each will carry, a fieldwork start date the firm will put in the engagement letter, and a report turnaround in weeks rather than "it depends".
Typical timing. Fieldwork for a small Type 2 runs two to four weeks, and a signed report usually follows four to eight weeks after the window ends. Busy seasons fill a quarter ahead, so an answer that sounds fast should come with a written date.
Common mistakes. Signing before you know whether the fieldwork is offshore or subcontracted, and assuming the report arrives the day fieldwork ends.
Red flag. A firm willing to examine a period that elapsed before any controls were in place, or to start a Type 2 without a readiness check. Both produce a report with exceptions your buyer will read.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
Scope, fee and independence
- What is excluded from this fee?
- Readiness, gap assessment, penetration testing, remediation advice and a second round of testing on failed controls are all commonly excluded and commonly assumed included. Get the list.
- What is the year two fee, and what would move it?
- A low first year on the expectation of recurring work is legitimate and worth knowing about in advance. Year two covers what genuinely changes.
- Under what circumstances would you bill above the quoted fee?
- Almost every Canadian engagement letter allows additional fees where the client is not ready. Ask what triggers it in practice and how much notice you get. What drives a quote covers the scope variables behind the number.
- What would you need to see from us to quote at the bottom of your range?
- The most useful question on this page, because the answer is a list of artifacts and the firm has just told you what its contingency is covering. Why audit quotes differ explains why an estimate carries that padding and what removes it.
- What can you not do for us because of independence?
- A good firm answers this crisply and unprompted: it cannot write your policies, design your controls, or select your tooling. A firm that offers to do your readiness as well as your audit is proposing something that will be questioned by a sophisticated reviewer, and possibly by its own quality control.
- How do you treat our subservice organisations, and does that change the fee?
- Carve-out and inclusive methods produce different reports and different fees. You want the firm's view before you sign, not after. How the two methods differ.
How to check the answers
What a good answer includes. A written fee that names the criteria, the window length, the number of systems and locations, and what is excluded, plus the year two fee and the rules for billing above the quote.
How to compare quotes. Put the three answers side by side on the same scope. The cheapest quote often excludes the readiness work, the report on a second criterion, or bridge letters, and those come back as change orders.
Independence, in practice. The firm that audits you cannot also build your controls or write your policies. If one firm offers both, ask how they separate the teams and read the AICPA independence rules they cite.
Canadian note. Ask whether the fee is in Canadian dollars and whether it includes HST or GST, travel and any currency adjustment. A quote in US dollars moves with the exchange rate between signing and invoicing.
Answers that should end the conversation
Some answers are not a negotiating position, they are a reason to stop.
| What you hear | Why it ends it |
|---|---|
| "We can do your readiness and your audit" | Independence. The report is weaker and a serious reviewer will spot who wrote the controls |
| "We guarantee a clean opinion" | Nobody can. An opinion is an outcome of testing, and a firm that promises one has told you what its testing is worth |
| "We can backdate the observation window" | The window is a period that was observed. There is no version of this that is not misconduct |
| "You will not need a penetration test" | True in the narrow sense that no criterion names one, misleading in the sense that your buyer will ask. A firm optimising your comfort over your outcome |
| "We use a platform, so it is mostly automated" | Platforms collect evidence. They do not perform testing, form conclusions or sign opinions. This answer describes a firm confusing its tooling with its work |
| Refusal to name the signing partner | You are buying a signature. Not knowing whose it is has no upside |
The Canadian question worth adding
Ask what the firm does about PIPEDA, Quebec's Law 25 and Ontario's PHIPA. The correct answer is that a SOC 2 examination does not address them and that they are separate obligations. A firm that claims the report covers your privacy law duties either does not know or is telling you what you want to hear, and both are disqualifying. How the two fit together.
The answers you get here are the baseline for the whole engagement. Write them into the engagement letter or a scope memo, because they are what you point to later when a request reaches past scope or a date slips. Managing your SOC 2 auditor covers what happens after you sign, and changing SOC 2 auditors covers what to do when the answers turn out not to hold.
What a good firm asks you
The questions run both ways, and a firm that asks you nothing on a first call is not scoping, it is selling. Expect to be asked which products are in scope, how many production cloud accounts you run, who your subservice organisations are, whether any customer named a Trust Services category, what period you want covered, and what evidence exists today. A firm that quotes without asking those has produced a number it will revise later.
Get three quotes on one scope
The quote form captures the scope these questions assume, so the answers you get back are comparable.
Get matchedWhat should I ask a SOC 2 auditor before signing?
Get five answers in writing: who signs the opinion and how many SOC 2 opinions they have signed, how many the firm issued last year, whether any fieldwork is subcontracted and to whom, the year two fee, and how long it takes from the end of fieldwork to a signed report. Those five predict your experience better than price does.
Can the same firm do our SOC 2 readiness and our audit?
It should not. Independence rules mean an audit firm cannot design or implement the controls it then examines. Firms that offer both are proposing an arrangement a sophisticated reviewer will question. Buy readiness from a consultant and the examination from a CPA firm.
How do I check a Canadian SOC 2 firm is really licensed?
Ask which provincial CPA body licences the firm and under what name, then check the register that body publishes. A consultancy without a CPA licence cannot issue the report regardless of how much of the work it does.
Is it a problem if the auditor subcontracts the fieldwork?
Not automatically, but you should know before you sign. Subcontracted fieldwork changes response times, who handles your evidence and which jurisdiction it moves through. Ask for the answer in writing and decide with it in front of you.
How many SOC 2 audits should a firm have done?
There is no rule, but under roughly ten a year and you are paying for a learning curve you will feel in the request list and the timeline. Ask for the count and for the signing partner's personal count, because a firm total can be one busy partner and four idle ones.