Overview
A SOC 2 audit must be performed and signed by a licensed CPA firm, and the firm you choose matters nearly as much as the report itself.
When a company starts using your product, they are trusting you with their data, along with the data of their own customers. If that data is ever exposed through your product, they are the ones who have to cover the cost of responding to the breach, and they risk losing contracts and customers as a result. Before they commit, their security team reviews your SOC 2 report to decide whether your product is secure enough to justify that risk and worth the investment.
The quality of the firm’s work determines the quality of that report, so a thorough audit gives them a sound basis for choosing you. If the audit behind it was not thorough and something later goes wrong, you are the one who loses their trust, and very likely their business as well.
The AICPA’s Warnings
As SOC 2 has become a standard request in B2B sales, a market has grown around making it fast and cheap. Many compliance platforms now advertise SOC 2 reports in a matter of weeks and refer their customers to partner audit firms. This convenience can be useful, but the American Institute of Certified Public Accountants (AICPA), which sets the standard SOC 2 audits follow, has raised concerns this year about the quality of some of the work behind it.
FEB 2026
Fast, cheap reports are pushing firms to cut corners
The AICPA’s Journal of Accountancy reported that marketing promising fast, easy SOC 2 reports is putting pressure on audit firms to cut corners. The article described reports that were identical apart from the client’s logo and advised companies to be cautious of offers that seem unrealistically fast, easy or cheap. It also warned about reports that rely too heavily on interviews, where the auditor accepts the company’s answers instead of testing whether its controls work.
APR 2026
Platform partnerships can threaten auditor independence
The AICPA published ethics guidance for CPA firms that enter business arrangements with SOC 2 tool providers, noting that these relationships can threaten the firm’s independence and objectivity.
MAY 2026
Peer reviewers are looking more closely at SOC 2 firms
The AICPA’s Peer Review Board told peer reviewers to look more closely at firms with SOC 2 practices, including firms that lean heavily on third-party platforms, work on unreasonable timelines or produce reports that are not tailored to each client.
ONGOING
The AICPA is looking into a compliance vendor
The AICPA’s SOC resource page also carries a notice that it is looking into allegations about the business practices of a compliance vendor offering SOC services, and that it will act against members found not to have followed professional standards.
A fast or affordable audit does not mean it is a poor one, but these warnings indicate why it is essential to pick your auditing firm carefully.
Criteria to be a SOC Auditor
Only a licensed CPA firm can issue a SOC 2 report. A compliance platform can help you prepare, collect evidence and connect you with an auditor, but it cannot perform the audit or sign the report itself. Before you commit to any offer, you should know the name of the CPA firm that will sign your report, and that firm should meet three basic requirements:
It is licensed.
The firm holds a current license from a state board of accountancy.
It is enrolled in peer review.
CPA firms that perform audits are regularly reviewed by other CPAs to check that their work meets professional standards.
It is independent.
The firm has no financial or business relationship with your company that would affect its judgment.
How to vet a SOC 2 auditor
Verify the firm’s license
You can look up any CPA firm on CPAverify, a free database run by the National Association of State Boards of Accountancy (NASBA). It uses licensing data from state boards and also shows enforcement or disciplinary actions. If you cannot find the firm, ask which state it is licensed in and check that state board directly.
Search CPAverify →Check the firm’s peer review
The AICPA Peer Review Public File shows whether a firm is enrolled in the AICPA Peer Review Program and when its most recent review was accepted. Not every firm publishes its full results there, so it is reasonable to ask the firm directly for its latest peer review report and whether it included any deficiencies.
Search the Public File →Ask about their experience with companies like yours
An auditor who regularly works with early-stage software companies will understand cloud infrastructure, small teams and fast-changing systems. Ask how many SOC 2 audits the firm completes each year, what kinds of companies they work with and whether they can share references from clients of a similar size.
Ask how they will test your controls
A credible audit involves more than asking your team questions and accepting the answers. Ask how the firm decides on sample sizes, what evidence they will request and how they test that a control actually works. If the answers are vague, or the firm suggests most of the work will be based on interviews alone, treat that as a warning sign.
Ask how they stay independent
If a compliance platform referred you to the firm, ask how that relationship works. Find out whether the firm is paid through the platform, whether the platform influences the timeline, and how the firm makes sure its conclusions are its own.
Confirm your customers will accept the report
Before you sign, it is worth asking your largest customers or prospects whether they have concerns about particular audit firms. Some enterprise security teams look closely at who signed a report, and if they do not trust the firm, they may continue to send you security questionnaires even after you share it.
RED FLAGS TO WATCH FOR
What a risky SOC 2 offer can look like
SOC 2 AUDIT PROPOSAL
Type II Report Package
Prepared for: Your company
A guaranteed result.
No legitimate auditor can promise a clean report before examining your controls.
A timeline that seems too short.
A Type II report requires an observation period of at least a few months, so any offer of a Type II report in a few weeks deserves a closer look.
A price far below other quotes.
Low prices can reflect efficient work, but they can also mean less testing.
No named CPA firm.
If the seller cannot tell you which licensed firm will sign your report, you have no way to verify who is doing the work, and you should get that answer before moving forward.
A firm you cannot find.
If the firm does not appear in CPAverify or the AICPA Peer Review Public File, ask why before going further.
Template reports.
If a sample report reads as though it could describe any company, the firm is likely using the same template for every client, and your report would probably be just as generic.
Pressure to buy bundled services.
An auditor that also sells you the controls it will later test has a conflict of interest.
CHECKLIST
Questions to ask before you sign
Bring these to your first call with any auditor.
After you receive the report
Read the report before you send it to customers.
SYSTEM DESCRIPTION
The system description should clearly describe your company, your product and your infrastructure.
CONTROLS
The controls should reflect the risks your business faces.
TESTS
The tests should match the controls they are meant to check.
If the report seems generic or leaves out important parts of your system, ask your auditor about it before you share the report with customers.
How Jutsu Can Help
A strong auditor will test whether your security controls actually worked over the audit period, which means you need a real record to show them. Jutsu monitors your connected cloud, identity, code and endpoint systems around the clock and logs every alert, investigation and response as it happens, maintaining all the evidence needed for your audit in one place so it is ready when your auditor asks for it. Jutsu does not act as your auditor but can help you become audit-ready.