What drives a SOC 2 quote

An audit fee is auditor hours times a rate. Nine scope variables account for most of the spread between quotes on the same company.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

The same twenty-five person Canadian SaaS company can get quotes of $22,000 and $58,000 CAD for a first Type 2, and neither firm is being dishonest. An examination fee is estimated auditor hours multiplied by a blended rate, and Canadian rates for this work run roughly $180 to $400 CAD an hour depending on the firm. Everything else is hours, and hours are driven by scope decisions you made before you asked anyone for a price.

So a quote is negotiable in a way most buyers do not realise. Not on rate, which is rigid, but on the nine variables below, several of which you can change in an afternoon.

The nine variables, ranked by how much they move the number

Criteria are the biggest lever you actually hold

Security is mandatory. The other four are not, and every one you add is another set of criteria for the auditor to design tests around, sample and document. Processing Integrity is the most expensive. The auditor has to understand what your system computes before it can test whether the computation is complete and accurate, which means walkthroughs of business logic rather than of infrastructure.

Include a category because a customer named it in writing, and not otherwise. A prospect saying they care about uptime is not the same as a contract naming the Availability criteria. What each category covers is worth ten minutes before you answer a scoping questionnaire. The answer you give there sets the fee.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Why evidence quality changes a fee after you signed

Most Canadian engagement letters are fixed fee against a stated scope, with language allowing additional fees where the client is not ready. Firms invoke it when a request list comes back with screenshots that do not show a date, tickets opened after the period ended, and an access review with no evidence of who reviewed it or when.

Each of those means a second request, a re-test, and often a partner conversation. Twenty of them is a week of extra time. The companies that come in at the bottom of their quoted range are the ones whose first evidence submission was complete, not the ones with the fewest controls. What the auditor will ask for is the list to work from before fieldwork rather than during it.

Evidence quality also moves the fee before you sign. A firm that cannot see your evidence holds hours back in case it is bad. That padding is separate from the nine variables above, and it responds to showing the firm your readiness position rather than to changing your scope. Why audit quotes differ works through how an auditor prices what it cannot see.

How to make three quotes comparable

Most buyers cannot compare their quotes because they did not send the same scope to each firm. The fix costs an hour.

1. Write one scope document: products in scope, cloud environments, headcount, Trust Services categories, report type, proposed period dates, and your subservice organisations.
2. Send the identical document to three firms and ask each to quote against it without changing it. A firm that proposes a different scope should say so separately, alongside the comparable number.
3. Ask each for the fee split between planning, fieldwork and reporting, and for the estimated hours. Firms that will not give hours are harder to compare and usually more expensive.
4. Ask what is excluded. Readiness, a gap assessment, the penetration test and remediation advice are commonly excluded and commonly assumed to be included.
5. Ask who signs the opinion and whether any fieldwork is subcontracted, and to whom.
6. Ask for the year two fee and what would move it.

The nine questions worth asking beyond price are on the auditor questions page. The fee anatomy itself, hour by hour, is on the audit cost page, and the other three lines of the first-year budget are on the full cost breakdown.

Is the cheapest quote a bad sign?

Not automatically, and the reflex that it must be is the more expensive mistake. A boutique specialist with a partner who has issued fifty SOC 2 opinions and no downtown office lease can price well below a national firm and produce a better report. The work is more efficient when the firm recognises your architecture without a tutorial.

What makes a low quote a bad sign is a specific pattern: an unusually low number attached to a firm that cannot say how many SOC 2 opinions it issued last year, will not name the signer, subcontracts the fieldwork, or quoted without asking about your subservice organisations. That combination is a firm that has underestimated the job and will come back for more money or issue something thin. Choosing between firm categories works through the trade-offs.