Why audit quotes differ for one company
Part of the gap between two quotes is scope, and part of it is the auditor guessing. The guessing part is priced, it is usually larger than buyers expect, and it is the part you can shrink before anyone puts a number on paper.
Two Canadian CPA firms will quote different numbers for the same SOC 2 for two reasons, and only one of them is well understood. The first is scope: they priced different report types, different Trust Services categories, different systems. That half is covered in detail on what drives a SOC 2 quote. The second reason is the one nobody puts in the engagement letter. An estimate is a forecast of hours, and a firm that cannot see your control environment prices the error in its own favour. You are paying for what the auditor does not know about you.
Scope is a decision. Uncertainty is a condition, and you can change it in the two weeks before you ask for quotes. Most companies do not try.
How uncertainty gets into the number
A partner building an estimate is ranging, not calculating. They think a first Type 2 at your size is somewhere between 90 and 150 hours, then decide where in that band to sit. A fixed fee means the firm carries the overrun, so quoting the optimistic end of every band loses money on the quarter of engagements that go badly. Those are almost always the ones where nobody could tell in advance how ready the client was.
- Estimated hours
- The work the firm expects if the engagement runs normally. Driven by scope, headcount and systems.
- Contingency
- Additional hours held back for the parts of your environment the firm cannot see yet. This is the uncertainty premium, and it is rarely itemised.
- Blended rate
- Roughly $180 to $400 CAD an hour across partner, senior and staff time. Fairly rigid, and the part buyers try hardest to negotiate.
- Re-quote clause
- The language allowing extra fees where the client is not ready. It exists because contingency is never enough on the worst engagements.
A firm has two ways to protect itself against a client who turns out to be unready: quote higher, or quote low and invoke the clause later. Both are worse for you than showing the firm enough that it does not need to protect itself.
What the auditor cannot see, and what it costs
Every row below is something a firm does not know when it prices a first engagement for a company it has never met. The right column is the artifact that answers it before the quote rather than during fieldwork.
| What the firm does not know | How it prices the unknown | What settles it in advance |
|---|---|---|
| Whether your controls exist or are aspirational | Extra walkthrough time, and a second round of testing assumed | A gap assessment with each control marked met, partial or absent |
| Whether evidence will arrive complete on the first request | The largest single contingency, because re-requests are unbudgeted partner time | A populated evidence register with dated artifacts already filed |
| Whether your policies match what you do | Time to reconcile documents against practice, and possible exceptions | An approved policy set with approval dates and an owner per document |
| Whether anyone owns the program day to day | Coordination overhead, which is the quiet cost of a first audit | A named internal owner, or a confirmed readiness firm |
| How your subservice organisations are treated | Report drafting time, and possibly a different opinion structure | A vendor register with the carve-out decision already made |
| Whether you will still be in scope in six months | Rarely priced, occasionally declined outright | A written scope naming products, environments and period dates |
| What the six artifacts cost you | A gap assessment and a fortnight of filing, or a readiness engagement you were going to buy anyway | |
None of those artifacts is produced for the auditor's benefit. You need all six to pass the audit regardless. Having them before the quote rather than after changes the price of the same audit.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
One engagement where the number actually moved
A disclosure first: TrazTech operates this site, and this is TrazTech's own engagement. Read it with that in mind.
On one engagement, the audit firm had issued a five-figure quote. The client then set out its readiness position in writing and confirmed a prep firm. The firm revised its number and took $11,000 CAD off it.
$11,000 CAD Off a five-figure quote, on one engagement, after the readiness position was documented
That is not a negotiated discount. Nobody argued about the rate and nobody threatened to walk. It is a smaller estimate because there was less uncertainty to price: the contingency sitting in the first number no longer had anything to cover. A discount is something you extract from a firm once. A smaller estimate is what the arithmetic produces every time the inputs change.
Read the number carefully
This happened once, on one engagement. It is one data point, not a rate. There is no average here, no typical saving and no promise that your number moves at all. Some firms quote from a rate card keyed to headcount and will not revise it for anything short of a scope change. What generalises is the mechanism, not the eleven thousand dollars.
What to send a firm before it quotes
The steps below cost about two weeks and invert the usual order, where a company asks for prices first and discovers its own gaps afterwards.
- Write the scope down: products, cloud environments, headcount, Trust Services categories, report type and proposed period dates. One page.
- Run a gap assessment against the criteria and record the result per control, including the ones you fail. Firms price an honest partial higher than nothing and much lower than a surprise.
- Build the evidence register and file two months of real artifacts into it, so the auditor can see the habit rather than the intention.
- Get the policy set approved and dated, with a named owner on each document.
- Decide who is running the program, whether that is an internal owner or a readiness firm, and say so in the request for a quote.
- Send the identical package to three firms, and ask each for estimated hours alongside the fee. Hours are where the contingency shows itself.
0 of 6 ready ·
If several of those are missing, you are not ready to be quoted yet. The guides on SOC2Prep are a faster route than collecting three numbers you cannot compare.
Who you name as the prep firm is part of the signal
A confirmed readiness firm reduces uncertainty, and not because of its reputation. It tells the auditor that somebody who has been through fieldwork before will be assembling the evidence, so requests come back in a form the firm can test. An internal owner who has done it twice does the same. A blank in that field does not.
It does not entitle you to a better price from a particular firm because of who you hired. Independence rules stop an audit firm being influenced on fee or opinion by a relationship with your consultant. A prep firm claiming preferential auditor pricing is describing something that would damage the audit if it were true. What a prep firm can do is make introductions and coordinate the engagement. Readiness consulting covers how those engagements are usually priced, and the auditor questions covers what to ask about independence directly.
When the quotes still differ, and that is fine
Remove the uncertainty and quotes converge, but they do not converge to one number. A boutique specialist and a national practice have different cost structures, and the spread that remains is roughly 1.3x to 1.6x between firm categories. That residual difference is real and it is not overcharging. What you want is a spread the firm can explain when you ask, so you are choosing on fit rather than guessing. The five kinds of firm is the piece that covers what you get for the difference, and the audit fee anatomy shows where the hours go.
Send one package to several firms
The quote form captures the scope and readiness position once, so every firm prices the same thing and none of them has to guess.
Get matchedCommon questions
Why do two audit firms quote different numbers for the same company?
Partly because they priced different scopes, and partly because they hold different amounts of contingency for what they cannot see. A firm with no visibility into your controls, evidence or policies assumes the work will be harder than average and prices accordingly. Send both firms the same written scope and the same readiness position and most of the second gap closes.
Can a readiness assessment lower my audit fee?
It can, because it removes hours the auditor would otherwise hold in contingency, and on one engagement a firm took $11,000 CAD off a five-figure quote after the readiness position was documented and a prep firm was confirmed. That was one engagement and not a rate. Some firms quote from a headcount table and will not revise for anything but a scope change, so treat a lower number as possible rather than expected.
Is a revised quote the same as a discount?
No, and the difference is worth holding onto. A discount is a firm accepting less money for the same estimated work. A revised estimate is the same arithmetic with better inputs, because the contingency held against an unknown control environment is no longer needed once the control environment is documented.
Should I tell the auditor about controls we have not built yet?
Yes. A known gap is cheaper to price than an unknown one, because the firm can plan around it and schedule the testing after your remediation date. Hiding it produces the worst outcome available, which is a firm that quoted on a clean assumption discovering the gap in fieldwork and invoking the re-quote clause.
How many firms should I ask?
Three, on an identical written scope, with estimated hours requested alongside each fee. Fewer than three gives you no sense of the band, and more than three costs you more coordination time than the extra number is worth.