How do we choose a CPA firm for a SOC 2 examination?

Start

We need to choose a CPA firm for a SOC 2 examination

The firm gives the opinion, so the choice matters for as long as you keep it. This pack names no firm and recommends none. Check each firm against facts you can ask for in writing: licence, peer review, independence, method, fee and the engagement letter.

• Then: Settle the report type, categories, system and dates first

Step

Settle the report type, categories, system and dates first

Quotes for different scopes cannot be compared, and the engagement letter can only be checked against a plan you already have. Settle the type, the categories, the system and its boundary, and the period dates before you ask for quotes.

• Then: Ask your customers whether they name firms or a standing

Step

Ask your customers whether they name firms or a standing

A customer may name the firms it accepts, or the standing it expects. Ask the customers who asked for the report, and keep each answer with your records. A customer's list is the customer's, and the pack names no firm.

• Then: Can the firm show a licence as a CPA firm?

Decision

Can the firm show a licence as a CPA firm?

A SOC 2 examination is performed by a licensed CPA firm. Ask for the licence in the State where the firm practises and record the date you checked it. The AICPA says it refers unlicensed firms and practitioners to state boards of accountancy, and a firm that cannot show a licence is a warning sign.

• Yes: Is it enrolled in peer review, with a recent result you can see?
• No, or not shown: Do not engage a firm that cannot show these

Decision

Is it enrolled in peer review, with a recent result you can see?

In a notice about allegations against a compliance vendor, the AICPA says that if the auditors involved are found to have not been enrolled in peer review, or to be unlicensed, it will act with respect to its members. Peer review results are one of the things to evaluate. Ask for the firm's most recent peer review report and result, in writing, and record the date you saw it.

• Yes: Will the firm stay independent and not build your controls?
• No, or not shown: Do not engage a firm that cannot show these

Decision

Will the firm stay independent and not build your controls?

The firm that examines you does not design or operate your controls or write your description. Ask how it keeps its independence, and which services it will and will not provide to a client it examines. The reassuring answer to whether it will design your controls is No. The same firm may offer readiness work. The AICPA Code of Professional Conduct allows some non-attest services for an attest client with safeguards, provided management keeps its responsibilities. Whether the firm stays independent is for the firm to confirm, so ask it to say how.

• Yes: Did a platform or readiness seller introduce or price the firm?
• No, or not known: Do not engage a firm that cannot show these

Outcome

Do not engage a firm that cannot show these

A licensed CPA firm that is independent of you and enrolled in peer review is what the pack asks for. Ask in writing, record the answers, and if a firm cannot show them, choose another. A tool or a consultancy cannot stand in for the firm.

Decision

Did a platform or readiness seller introduce or price the firm?

A readiness helper, a tool provider or a referral platform is not the auditor. Terms that move control, judgement, financial dependency, promotion or access to evidence toward a tool provider can threaten the firm's compliance with the Code of Professional Conduct. If you do not know how the firm came to you, find out.

• Yes, or not known: Ask for the arrangement and its terms in writing
• No: Ask about experience, who signs and a sample report

Step

Ask for the arrangement and its terms in writing

Put the question to the firm and to the helper, and read the answer closely. A firm introduced and priced by a platform that also sells you your readiness work is a warning sign. It is a prompt to look closer, not a verdict.

• Then: Ask about experience, who signs and a sample report

Step

Ask about experience, who signs and a sample report

You are buying judgement, not a template. Ask how many SOC 2 examinations the firm has issued for organisations like yours, how many examiners it has and how many reports each signs in a year, and who does the fieldwork. Ask for references, and for a sample report that reads as tailored to its system.

• Then: Ask how it tests, treats providers and handles exceptions

Step

Ask how it tests, treats providers and handles exceptions

Ask how the firm chooses what it tests and how big its samples are, whether its procedures suit your controls, and how much rests on questions to you rather than on records. Ask how it treats each subservice organisation, as carve-out or inclusive, and how it handles exceptions: when you are told, how you respond and how the response appears.

• Then: Compare quotes for the same scope, dates and fee terms

Step

Compare quotes for the same scope, dates and fee terms

Ask each firm for a fixed fee for the stated scope and what it includes: fieldwork, a Type 1, a Type 2, retests, extra systems and a SOC 3 report. Ask what happens to the fee if scope grows, the period is extended or a retest is needed, how long the report takes after the period ends, and how much of your team's time it expects.

• Then: Does any warning sign show?

Decision

Does any warning sign show?

The eight signs are a guaranteed result, a report in days or weeks, no licence or peer review shown, the same report as every other client, a price far below the others, a platform that introduced and priced the firm, tests that are mostly questions to you, and very few signers for very many reports. A sign is a prompt to look closer, not a verdict.

• Yes, or not known: Put the linked questions in writing and look again
• No: Does the draft letter match your plan on all 14 points?

Step

Put the linked questions in writing and look again

Each sign is linked to the questions that show it. Ask them in writing: a short answer in writing is worth more than a long answer said. Compare at least two firms if you can.

• Then: Do the written answers clear the sign?

Decision

Do the written answers clear the sign?

A sign that the written answers clear does not need to stop the choice. A sign that stays, or an answer you do not have, is a reason to compare another firm before you engage. The decision is yours.

• Yes: Does the draft letter match your plan on all 14 points?
• No, or not known: Compare another firm before you engage

Outcome

Compare another firm before you engage

The pack ranks and scores no firm. The comparison counts answers and warning signs for each named firm side by side, and a count is not a recommendation. Return to the questions with the next firm.

Decision

Does the draft letter match your plan on all 14 points?

The 14 points are what a service organisation settles in writing with the firm: type, categories, system, boundary, providers, dates, deliverables, management's part, independence, fees, change terms, timeline, restrictions on use and exceptions. They are not a list of what a letter must contain, which the firm states. A point that differs from your plan needs a note.

• Yes: Sign the letter and keep the answers with your records
• No, or not known: Ask for the letter to change, or note why you accept it

Step

Ask for the letter to change, or note why you accept it

Write down each point that differs from your plan. Either ask the firm to change the letter, or record why you accept the difference and who accepted it. Then check the letter again.

• Then: Does the draft letter match your plan on all 14 points? (back to an earlier step)

Outcome

Sign the letter and keep the answers with your records

Put the agreed dates into the observation period calendar, the scope into the scoping assessment and the system description, and keep the firm's answers and the signed letter with your records. Choosing the firm does not decide the opinion: the firm tests and forms its own.