How to check that your SOC 2 auditor and report are legitimate

Why this matters: SOC 2 is an attestation, not a certification

A SOC 2 report is an attestation issued under AICPA Statement on Standards for Attestation Engagements 18 (SSAE 18, AT-C sections 105 and 205). An attestation requires:

• A licensed CPA firm as the service auditor.
• Independence between the auditor and the service organisation.
• An examination performed to AICPA standards, including planning, risk assessment, testing by sampling, and evidence evaluation.
• A written report expressing an opinion on management's assertion.

Anything else — a “SOC 2” document issued by a compliance platform, a certification body or a consultant who is not a CPA firm — is not a SOC 2 report. The buyer who asks you for one will reject it.

The seven-step verification checklist

1. 1

   Confirm the firm is a CPA firm

   Only a licensed CPA firm registered with a US state board of accountancy can issue a SOC report. Ask the firm for its state(s) of licence and verify on the state board's public registry.

2. 2

   Verify AICPA peer review status

   AICPA peer review is required for CPA firms performing attestation engagements. Ask for the firm's most recent peer review acceptance letter and confirm the firm appears in the AICPA Peer Review Public File.

3. 3

   Check SOC-specific experience

   Not every CPA firm does SOC engagements. Ask how many SOC 2 engagements the firm has signed in the past 12 months, which industries, and whether the engagement partner has signed SOC reports before. Request two references.

4. 4

   Read the engagement letter carefully

   The letter must reference SSAE 18 (AT-C sections 105 and 205), name the Trust Services Criteria in scope, state Type 1 or Type 2 and specify the examination period (Type 2 only). Vague language is a red flag.

5. 5

   Expect sampling, not just document review

   A legitimate SOC 2 engagement includes testing by sampling — walking through controls, reviewing evidence samples, interviewing control owners. A firm that only reads your policies and signs a report has not performed an examination.

6. 6

   Confirm independence

   Your auditor cannot also sell you consulting services that create a self-review threat. If the same firm is helping you implement controls and auditing those same controls, independence is impaired.

7. 7

   Inspect the final report's required sections

   A SOC 2 report must contain: an independent service auditor's report, management's assertion, a description of the system, applicable Trust Services Criteria, and (for Type 2) the auditor's tests of controls and results. If any section is missing or thin, the report is not a legitimate SOC 2.

Red flags that signal a problem

• No licensed CPAs at the firm. If you can't find a named CPA at the firm on a state board registry, it isn't a CPA firm, no matter how it brands itself.
• Report turnaround in days without a mature control environment. A one-week Type 1 can be legitimate for a startup with a complete, well-documented control set; it cannot be legitimate for one that doesn't.
• No sampling, no interviews, no walkthroughs. If the auditor never talks to a control owner or asks for evidence samples, they're not performing an examination.
• Same firm implementing and auditing. Independence is impaired when the auditor is also selling you consulting on the same controls.
• Pressure to use a specific platform. Legitimate auditors are platform-neutral and work from your evidence, not a lock-in dependency.
• Report with no management assertion. The management assertion is a required section; its absence means the report structure is wrong.
• Vague scope. “SOC 2 compliant” without naming Type, period, criteria or auditor is marketing, not an attestation.
• No peer review on file. A CPA firm performing SOC 2 engagements should have a current acceptable peer review in the AICPA Public File.

What a legitimate SOC 2 report contains

Whether Type 1 or Type 2, a SOC 2 report must contain these sections:

1. Independent service auditor's report. Signed and dated by the CPA firm, naming the service organisation, the system, the applicable Trust Services Criteria, and (for Type 2) the examination period. Includes the auditor's opinion.
2. Management's assertion. A statement from your management asserting that the description is fair, the controls were suitably designed (Type 1) and operated effectively (Type 2), signed and dated.
3. Description of the service organisation's system. Services provided, infrastructure, software, people, procedures, data, incidents, subservice organisations and complementary user entity controls.
4. Applicable Trust Services Criteria and related controls. The specific criteria in scope (security always; availability, processing integrity, confidentiality, privacy optional) and the controls designed to meet them.
5. Service auditor's tests of controls and results (Type 2 only). The tests performed, the samples examined, and the results, including any exceptions.

If any of these sections is missing, the document is not a complete SOC 2 report. If exceptions in section 5 are not disclosed and the opinion is still unqualified, something is wrong.

How buyers validate the report you send them

Sophisticated buyers run the same checks on your report that you should be running on them:

• Look up the issuing firm on a state board registry.
• Check the AICPA Peer Review Public File for the firm.
• Read the opinion first — unqualified, qualified, adverse or disclaimer — before reading anything else.
• Note the examination period and confirm it covers the current year with a bridge letter if dated.
• Check that criteria in scope match what they asked for (buyers who need Confidentiality in scope will reject a Security-only report).
• Look for exceptions in section 5. Exceptions are not disqualifying, but unexplained exceptions are.

Give your buyers a trust centre that already answers these questions and the report request becomes a signature instead of a diligence loop.

Picking an auditor: what to ask on the first call

1. Which state(s) is the firm licensed in?
2. When was the last AICPA peer review and what was the result?
3. How many SOC 2 engagements has the firm signed in the past 12 months?
4. Who will be the engagement partner and have they signed SOC 2 reports before?
5. What's the planned mix of walkthroughs, control testing and sampling?
6. What's the typical path from kickoff to Type 1 report sign?
7. What's the path from Type 1 to Type 2, and what observation window do you expect?
8. Will you accept evidence from our compliance platform or do you need re-collection?
9. Who signs the engagement letter, and does it reference SSAE 18 explicitly?
10. How do you handle exceptions — what's the remediation path before report sign?

Switching auditors mid-cycle

Startups do switch auditors — because of fit, because of cost, or because of a quality concern. The switch is normal if planned around the attestation cadence. A new auditor can issue your next report, provided they are willing to accept the control environment described in the previous report and plan their own testing.

If the switch is because the previous auditor's legitimacy is in question, treat the previous report as unreliable until you can confirm it meets the checks above. In some cases a reissued report from a legitimate firm is the only clean path.

Frequently asked questions