Auditor (CPA Firm) Selection & Engagement Checklist

Questions to ask and points to settle when choosing the licensed CPA firm that will examine you: independence, peer review, scope, timeline and cost structure.

Available soon

Format: Excel
Size: 67 KB
Length: 13 sheets
Version: 1.1
Updated: 18 Oct 2026

Follow this documentFree account. We can email you when it changes.

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	What this is. The Auditor (CPA Firm) Selection & Engagement Checklist of the SOC 2 Report Readiness pack. A SOC 2 report is an attestation by a licensed CPA firm. Choosing the firm is your decision. This pack names no firm and recommends none. Firm names here are [[placeholders]] that you fill in.
2	Firms sheet. Name up to four firms. Record what you saw: the licence, the peer review report, how the firm came to you and when you had a quote.
3	Questions sheet. Ask every question of every firm and record each answer: "Yes, in writing", "Yes, said", "No", "Not asked yet", "Not applicable". Ask for answers in writing where you can. The column Yes means says what a Yes is for each question. For AS-05 and AS-07 the reassuring answer is No.
4	Why and Source. Each question says why it matters and where that comes from: pages of the Journal of Accountancy and of the AICPA & CIMA, read on 18 October 2026. The AICPA Ethics Staff Insights text itself was not read.
5	Warning Signs sheet. The eight signs RF-01 to RF-08 are linked to the questions. Each firm's column says Triggered, Not triggered or Not enough answers. A sign is a prompt to look closer. It is not a verdict on a firm.
6	Engagement Letter sheet. Before you sign, check the draft letter against the 14 points and your plan. A point that differs from your plan needs a note.
7	Comparison sheet. Counts for each firm of each answer and of the warning signs. Counts only: no ranking, no score and no recommendation. The choice is yours.
8	After you choose. Put the agreed dates into the Observation Period & Exceptions Calendar, the scope into the SOC 2 Report Scoping Assessment and the System Description & Boundary Template, and keep these answers and the signed letter with your records.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.

The questions are market practice and the AICPA's published concerns. They are not a test the AICPA sets. The standards that govern a SOC 2 examination were not read, and the CPA firm states which apply and what its engagement letter must contain.

EXAMPLE: Acme Corp (EXAMPLE). The Example sheet shows two invented firms answering eight questions. Delete it before you rely on the workbook.

Adapting this template:

• Small organisation: compare at least two firms if you can, and ask every question of each. A small firm may answer some questions in a sentence. A short answer in writing is worth more than a long answer said.

• Regulated or customer-driven organisation: a customer may name the firms it accepts, or the standing it expects. Ask the customer, and keep its answer with this workbook. A customer's list is the customer's. This pack names no firm and recommends none.

• Organisation that uses outsourced providers or a readiness helper: record on the Firms sheet how each firm came to you. If a platform, a tool provider or a consultancy introduced it, ask AS-06 and read the answer closely. A helper is not the auditor (SR-24).

• Replace every [[placeholder]] with your own text. Keep the formulas.

Firms

The firms you are comparing

Name up to four firms and record what you saw. Names stay [[placeholders]] until you fill them in. A firm with no name is left out of the counts.

The firms

Firm	Name	State of licence	Licence checked on	Peer review report seen on	How the firm came to you	Quote received on	Notes
Firm 1	[[Firm 1 name]]
Firm 2	[[Firm 2 name]]
Firm 3	[[Firm 3 name]]
Firm 4	[[Firm 4 name]]

How the firm came to you matters. Say if a platform, a tool provider or a consultancy introduced it, and ask AS-06.

Questions

Ask every question of every firm. Sources are pages of the Journal of Accountancy and of the AICPA & CIMA, read on 18 October 2026. The AICPA Ethics Staff Insights text itself was not read (AS-06). Firm names are entered once, on the Firms sheet.

							Firm 1	Firm 2	Firm 3	Firm 4
Question	Group	What to ask	Yes means	Why it matters	Source	Raises a sign when the answer is	Firm 1 answer	Firm 2 answer	Firm 3 answer	Firm 4 answer	Notes
AS-01	Licence and standing	Is the firm a licensed CPA firm in the State where it practises, and can it show the licence?	The firm shows a current licence in the State where it practises.	A SOC 2 examination is performed by a licensed CPA firm. The AICPA says it refers unlicensed firms and practitioners to state boards of accountancy.	SOC 2 Peer Review	No
AS-02	Licence and standing	Is the firm enrolled in peer review, and can it share its most recent peer review report and result?	The firm shows it is enrolled in peer review and shares its latest report and result.	In a statement about allegations against a compliance vendor, the AICPA says that if the auditors involved are found to have not been enrolled in peer review, or to be unlicensed, it will act with respect to its members. Peer review results are one of the things to evaluate.	SOC 2 Peer Review	No
AS-03	Licence and standing	Who signs the report, and are they a licensed CPA?	The signer is named and shown to be a licensed CPA.	The person signing is the person accountable.	SOC 2 Peer Review
AS-04	Independence	How does the firm maintain its independence from you, and what is its policy on services it will and will not provide to a client it examines?	The firm gives its independence policy, including the services it will not provide to a client it examines.	A Journal of Accountancy article advises service organisations to ask how the firm maintains its independence.	SOC 2 Firm Questions
AS-05	Independence	Has the firm, or anyone connected to it, done readiness or advisory work for you, or will it? Will it design your controls, write your policies, or operate your tools while examining you? If it has done readiness work, how does it keep its independence?	The firm or someone connected to it would design your controls, write your policies or operate your tools while examining you.	The firm that examines you does not design or operate your controls or write your description (SR-24). Readiness or advisory work by the same firm is an answer to read closely, not an automatic no: management keeps the decisions and the responsibility for the controls and the description (the AICPA Code limits nonattest services, so ask the firm what safeguards it applies).	SOC 2 Firm Questions	Yes
AS-06	Independence	Does the firm have a business arrangement with a compliance tool provider, a referral platform or a readiness consultancy that you are using, and what are its terms?	The firm has such an arrangement. Read its terms.	Arrangements that move control, judgement, financial dependency, promotion or access to evidence toward a tool provider can threaten compliance with the Code of Professional Conduct.	SOC 2 Tool Providers	Yes
AS-07	Independence	Does anyone promise you an outcome, a result, or that you will have no exceptions?	Someone promises an outcome, a result or no exceptions.	A referral platform that promises favourable outcomes puts independence in question.	SOC 2 Firm Questions	Yes
AS-08	Experience and capacity	How many SOC 2 examinations has the firm issued, and for service organisations like yours?	The firm states how many SOC 2 examinations it has issued, including for organisations like yours.	Evaluate the firm's qualifications and experience.	SOC 2 Firm Questions
AS-09	Experience and capacity	How many SOC examiners does the firm have, and how many reports does each sign in a year?	The firm states its numbers of examiners and reports, and you judge them reasonable.	A small number of examiners signing very many reports is a warning.	SOC 2 Firm Questions	No
AS-10	Experience and capacity	Who will do the fieldwork, and how much of it is done by the people who sign?	The firm says who does the fieldwork and that the signers do a real share of it.	You are buying judgement, not a template.	SOC 2 Firm Questions
AS-11	Experience and capacity	Can the firm give references from service organisations of your size and kind?	The firm gives references from organisations of your size and kind.	Evaluate the firm's size, capacity and client references.	SOC 2 Firm Questions
AS-12	Scope and method	Does the firm confirm the type, the categories, the system and the boundary in writing before fieldwork?	The firm confirms type, categories, system and boundary in writing before fieldwork.	Scope is agreed in the engagement letter.	Practice (not an AICPA rule)
AS-13	Scope and method	How does the firm choose what it tests and how big its samples are, and are they tailored to your controls and risks?	The firm explains tests and sample sizes tailored to your controls and risks.	Identical sample sizes and testing across clients are a red flag for reviewers.	SOC 2 Peer Review Focus	No
AS-14	Scope and method	Are its test procedures suited to your controls, and how much does it rely on asking you rather than inspecting records?	Its procedures suit your controls and mostly inspect records.	A rushed or automated report may rely too heavily on inquiry.	SOC 2 Firm Questions	No
AS-15	Scope and method	How does the firm treat subservice organisations: carve-out or inclusive, and what does it need from them?	The firm explains its method for each subservice organisation and what it needs.	The method is decided for each subservice organisation (SR-06).	SOC 2 Carve-Out
AS-16	Scope and method	How does the firm handle exceptions: when you are told, how you respond, and how the response appears in the report?	The firm explains when you are told of an exception and how your response appears.	The firm decides how an exception is reported; management responds (SR-17).	Practice (not an AICPA rule)
AS-17	Timeline and fees	What period lengths will the firm accept, and when does it want the dates in writing?	The firm states the period lengths it accepts and when it wants dates in writing.	There is no minimum period in the sources read; the firm and your customers decide (SR-16).	SOC 2 Observation Period
AS-18	Timeline and fees	How long after the period ends does the firm usually issue the report?	The firm states how long after the period ends it usually issues the report.	Plan the bridge and the next period around it (A08).	Practice (not an AICPA rule)
AS-19	Timeline and fees	Is the timeline realistic for the work, or unrealistically fast?	You judge the timeline realistic for the work.	Reviewers treat unreasonable timelines as a raised risk.	SOC 2 Peer Review Focus	No
AS-20	Timeline and fees	Is the fee fixed for the scope, and what is included: fieldwork, a Type 1, a Type 2, retests, extra systems, a SOC 3 report?	The fee is fixed for a stated scope, the letter lists what it includes, and you judge it in line with the other quotes.	An offer that is unrealistically cheap may leave obvious deficiencies.	SOC 2 Firm Questions	No
AS-21	Timeline and fees	What happens to the fee if the scope grows, the period is extended, or you need a retest?	The firm states how the fee changes if scope, period or retests change.	Surprises in cost are a reason to compare engagement letters.	SOC 2 Firm Questions
AS-22	Timeline and fees	How much of your team's time does the firm expect during fieldwork, and through which channel are requests made?	The firm states the time it expects from your team and how requests are made.	Plan control owners' time (A05).	Practice (not an AICPA rule)
AS-23	The report and after	May you review a draft of the report and the description before it is final, and what can you correct?	The firm lets you review a draft of the report and description and says what you may correct.	Management owns the description (SR-02).	Practice (not an AICPA rule)
AS-24	The report and after	Who may receive the report, and how does the firm word its restriction on use?	The firm says who may receive the report and how it words the restriction.	SOC 2 reports are generally restricted in use (SR-21).	SOC 2 Use
AS-25	The report and after	Does the firm issue a SOC 3 report from the same examination, and at what cost?	The firm issues a SOC 3 report from the same examination and states the cost.	A SOC 3 report is for general use.	SOC 2 Use
AS-26	The report and after	Will you see a sample report from the firm, and does it read as tailored to its system?	You see a sample report and it reads as tailored to its system.	Review the finished report: is it tailored to the system examined?	SOC 2 Firm Questions	No
AS-27	The report and after	Will the firm continue next period, and how are consecutive periods scheduled so that none is uncovered?	The firm will continue next period and schedules periods so that none is uncovered.	The next period starts the day after the last ends (SR-16).	SOC 2 Observation Period
AS-28	The report and after	What will the firm say if a customer calls to check the report?	The firm says what it will tell a customer who calls to check the report.	Customers check; the firm answers for its report.	Practice (not an AICPA rule)

Warning Signs

Warning signs

Eight signs, each linked to the questions that show it. A sign is a prompt to look closer. It is not a verdict on a firm. A firm with no name is left out.

The signs

Sign	What it looks like	Questions	Answer that raises it
RF-01	A guaranteed result, “no exceptions” or a guaranteed unqualified opinion.	AS-07	AS-07: Yes
RF-02	A report in days or a few weeks, or a period shorter than the firm can test properly.	AS-19	AS-19: No
RF-03	The firm cannot show a licence, a peer review enrolment or a recent peer review result.	AS-01, AS-02	AS-01: No; AS-02: No
RF-04	The same report, controls and testing as every other client; a template you recognise.	AS-13, AS-26	AS-13: No; AS-26: No
RF-05	The price is far below the others, or bundled with services that would put independence in question.	AS-20, AS-05	AS-20: No; AS-05: Yes
RF-06	The firm is introduced and priced by a platform that also sells you your readiness work.	AS-06	AS-06: Yes
RF-07	Tests that are almost all questions to you, and few inspections of records.	AS-14	AS-14: No
RF-08	A very small number of signers for a very large number of reports.	AS-09	AS-09: No

Triggered: a linked question has the answer shown. Not enough answers: none is triggered, and a linked question is unanswered or Not asked yet. Not triggered: every linked question is answered and none raises the sign. Not applicable counts as answered.

A No is not always a reason for concern. For AS-05 and AS-07 the reassuring answer is No. A Yes said does not raise a sign, so ask for AS-01 and AS-02 in writing.

Engagement Letter

These are the points a service organisation settles in writing with the CPA firm. They are not a list of what an engagement letter must contain. The CPA firm states that, under the standards that apply to your engagement.

Point	Item	What to check in the letter	Decided in	Questions	Check (calc)
Firm whose letter this is:		[[Firm name]]
EL-01	Type of report	Type 1 or Type 2, as you planned.	P32-A02, SR-05	AS-12	Status needed
EL-02	Categories	Security and any others you chose, and no others.	P32-A02, P32-A04, SR-03	AS-12	Status needed
EL-03	The system	The one service, named as in your description.	P32-A03, SR-04	AS-12	Status needed
EL-04	The boundary	What is outside the boundary is stated.	P32-A03, SR-04	AS-12	Status needed
EL-05	Subservice organisations	Carve-out or inclusive, for each provider.	P32-A03, SR-06	AS-15	Status needed
EL-06	Period dates	The start and end dates, or the date of a Type 1 report, in writing.	P32-A08, SR-16	AS-17	Status needed
EL-07	Deliverables	The report, a draft for your review, and a SOC 3 report if you want one.	SR-21	AS-23, AS-25	Status needed
EL-08	Management's part	Management writes the description and the assertion. The firm does not.	SR-02	AS-05	Status needed
EL-09	Independence statement	The firm's statement of independence and the services it will not provide.	SR-23, SR-24	AS-04, AS-05	Status needed
EL-10	Fees	A fixed fee for the stated scope, and what it includes.	Your budget	AS-20	Status needed
EL-11	Change terms	What happens to the fee and the dates if scope grows, the period is extended or a retest is needed.	Your budget, SR-16	AS-21	Status needed
EL-12	Timeline	Fieldwork dates, how quickly you must answer requests, and when the report is issued.	P32-A08, P32-A05	AS-18, AS-22	Status needed
EL-13	Report use restrictions	Who may receive the report, and the wording of the restriction.	SR-21	AS-24	Status needed
EL-14	Exceptions	When you are told of an exception, and how your response is recorded.	SR-17	AS-16	Status needed

Comparison

Comparison

Counts for each firm, side by side. A firm with no name on the Firms sheet is left out.

This pack neither names nor recommends any firm. The counts below are counts of answers. They are not a ranking, a score or a recommendation of a firm.

Answers and warning signs, for each firm

Count	Firm 1	Firm 2	Firm 3	Firm 4
Firm name	Not named	Not named	Not named	Not named

Yes, in writing

Yes, said

Not asked yet

Not applicable

No answer yet

Warning signs triggered

Warning signs with not enough answers

Firms named	0

Answers of No, by group

Group	Firm 1	Firm 2	Firm 3	Firm 4

Licence and standing

Independence

Experience and capacity

Scope and method

Timeline and fees

The report and after

Answers of Not asked yet, by group

Group	Firm 1	Firm 2	Firm 3	Firm 4

Licence and standing

Independence

Experience and capacity

Scope and method

Timeline and fees

The report and after

The engagement letter, point by point

Count	Points
Points marked: Stated in the letter	0
Points marked: Not in the letter	0
Points marked: Different from our plan	0
Points marked: Not yet seen	0
Points with no status yet	14
Points whose row is incomplete	14

Counts of answers and of points. A count is not a ranking and not a score. A No is not always a concern: see the Warning Signs sheet.

Example

EXAMPLE: two firms answer eight questions

Acme Corp (EXAMPLE) is invented, and so are the two firms and their answers. Neither is a real firm. The example shows that a count of No answers is not enough on its own: read each answer with its question.

Eight questions

Label	Question	Yes means	Raises a sign when the answer is	[[Firm A]] (EXAMPLE) answer	[[Firm B]] (EXAMPLE) answer	[[Firm B]] (EXAMPLE) reading (calc)
EXAMPLE	AS-01	The firm shows a current licence in the State where it practises.	No	Yes, in writing	Yes, in writing
EXAMPLE	AS-02	The firm shows it is enrolled in peer review and shares its latest report and result.	No	Yes, in writing	Not asked yet
EXAMPLE	AS-05	The firm or someone connected to it would design your controls, write your policies or operate your tools while examining you.	Yes	No	No
EXAMPLE	AS-06	The firm has such an arrangement. Read its terms.	Yes	No	Yes, said	Raises a warning
EXAMPLE	AS-07	Someone promises an outcome, a result or no exceptions.	Yes	No	No
EXAMPLE	AS-09	The firm states its numbers of examiners and reports, and you judge them reasonable.	No	Yes, said	No	Raises a warning
EXAMPLE	AS-19	You judge the timeline realistic for the work.	No	Yes, said	Yes, said
EXAMPLE	AS-20	The fee is fixed for a stated scope, the letter lists what it includes, and you judge it in line with the other quotes.	No	Yes, in writing	No	Raises a warning

What the counts say for these eight questions

Count	[[Firm A]] (EXAMPLE)	[[Firm B]] (EXAMPLE)
Answers of No	3	4
Answers of Not asked yet	0	1
Answers that raise a warning	0	3

The counts of No are close. The readings are not: none of the first firm's answers raises a warning, and three of the second firm's do. A No to AS-05 or AS-07 is reassuring.

Lists

ListAnswer	ListLetterStatus
Yes, in writing	Stated in the letter
Yes, said	Not in the letter
No	Different from our plan
Not asked yet	Not yet seen

Not applicable

Definitions

Definitions

Term	Meaning in this workbook
CPA firm	The licensed firm of certified public accountants that examines management's description and its controls and issues the report. Also called the auditor and the service auditor.
Licence	The CPA firm's licence to practise in the State where it works. A SOC 2 examination is performed by a licensed CPA firm.
Peer review	A review of a CPA firm's own work by other CPAs. Ask the firm for its latest result.
Independence	The firm's freedom from any interest that would affect its judgement about you (SR-24).
Engagement letter	The written agreement between you and the CPA firm: scope, dates, fees, responsibilities and use of the report.
Warning sign	A pattern in a firm's answers or offer that the sources read treat as a reason to look closer. It is a prompt, not a verdict.
Yes, in writing	The firm says yes and you hold it in a document.
Yes, said	The firm says yes, but not in writing. Ask for it in writing.
Not asked yet	You have not put the question to this firm.
Not applicable	The question does not apply to this firm or to your engagement.
SOC 2 report	A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.
AS-nn, RF-nn, EL-nn	AS-nn are the questions, RF-nn the warning signs and EL-nn the points of the engagement letter. SR-nn are rules of the pack's Guide.
EXAMPLE	A worked example: Acme Corp (EXAMPLE). Every name and value is made up. Delete before use.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.19 — Information security in supplier relationships	Questions and Engagement Letter sheets: the questions put to a provider and the terms agreed with it before and at the start of the relationship, here with the CPA firm
NIST CSF 2.0	GV.SC-06 — “Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships”	Questions and Warning Signs sheets: planning and due diligence before entering a relationship with a provider, here the CPA firm
AICPA, SOC 2	The AICPA & CIMA says it promulgates the professional standards for SOC engagements. In a statement about allegations concerning a compliance vendor, it says that if auditors involved “are found to have not performed audits in accordance with professional standards, not been enrolled in peer review, and/or are unlicensed”, it will take action with respect to its members, and that it assists regulators, including by referrals to state boards of accountancy, regarding unlicensed firms and practitioners (SOC suite of services page, read 18 October 2026). A CPA licence and enrolment in peer review are therefore things a service organisation asks a firm to show	Questions sheet, AS-01 to AS-03: licence, peer review enrolment and the signer
AICPA, SOC 2	A service organisation should evaluate the firm's “qualifications, experience, and peer review results”, ask how the firm maintains its independence and which sampling procedures it will use, ask whether the test procedures suit the controls, and treat an offer that is “unrealistically fast, easy, or cheap” as a warning; independence “could be questioned” where a firm agrees to unrealistic deadlines or a referral platform promises favourable outcomes (Journal of Accountancy, 1 February 2026)	Questions sheet, AS-04 to AS-14, AS-20, AS-21 and AS-26: independence, experience, method and cost
AICPA, SOC 2	In May 2026 the AICPA's Peer Review Board told reviewers to look at firms with SOC 2 practices for engagements that share identical reports, risk assessments, sample sizes or testing procedures, and to treat unreasonable engagement timelines as a raised risk (Journal of Accountancy, 14 May 2026)	Questions sheet, AS-13, AS-19 and AS-26, and Warning Signs RF-02 and RF-04: tailored testing and realistic timelines
AICPA, SOC 2	AICPA Ethics Staff Insights of April 2026 on business arrangements with SOC tool providers: terms that shift control, professional judgement, financial dependency, promotion or access to evidence away from the CPA and toward the tool provider, or that limit the CPA's ability to set scope and timing, obtain evidence, communicate deficiencies or remain objective, can create threats to compliance with the Code of Professional Conduct (as the Journal of Accountancy reported it in April 2026; the Insights text itself was not read)	Questions sheet, AS-06, and Warning Signs RF-06: arrangements with a tool provider or platform. The Insights text itself was not read
AICPA, SOC 2	A SOC 2 examination is an attestation engagement performed under the AICPA's attestation standards. The AICPA's SOC 2 guide (October 2022, read on 20 October 2026) is an interpretive publication under AT-C section 105 and applies AT-C sections 105 and 205; secondary sources identify the standards as SSAE 18 (effective for reports dated on or after 1 May 2017). Later statements renumbered or revised some sections. The text of the standards was not read, and the CPA firm states which apply to your engagement	Questions sheet: no question rests on these (AS-12, AS-16, AS-18, AS-22, AS-23 and AS-28 are practice); Engagement Letter sheet: scope and method in the engagement letter. The standards were not read
AICPA, SOC 2	Where a service organisation uses a subservice organisation, the description uses either the carve-out method (the subservice organisation's relevant controls are left out of the description and the tests, and the description names the controls it assumes the subservice organisation operates) or the inclusive method (those controls are included). Management chooses for each subservice organisation. DC 7 in DC section 200 (read 20 October 2026) says what the description discloses under each method: under the inclusive method the nature of the service, the necessary controls, the relevant aspects of the subservice organisation's system and the portions attributable to it; under the carve-out method the nature of the service, the criteria intended to be met by the subservice organisation's controls and the types of controls assumed (CSOCs). The AICPA's SOC 2 guide (October 2022, read on 20 October 2026) adds that the inclusive method needs the subservice organisation's agreement, that its controls are subject to the service auditor's procedures, and that it makes the subservice organisation a responsible party, so the CPA firm must be independent of both (paragraphs 2.14 and 2.17); the text of the attestation standards was not read	Questions sheet, AS-15, and Engagement Letter EL-05: the method for each subservice organisation
AICPA, SOC 2	The AICPA's SOC 2 guide (October 2022, read on 20 October 2026 in the free PDF on the AICPA site) sets no minimum observation period for a Type 2 report. It says (paragraph 2.54) that for a period of less than two months a service auditor may conclude that sufficient evidence is unlikely, and that for nine months it is likely, and it leaves the decision to the CPA firm. Three, six and twelve months are what advisory sources call common, and customers set their own expectations. This is market practice, and the pack prints it as market practice, not as a rule of the AICPA. The CPA firm agrees the period in the engagement letter	Questions sheet, AS-17 and AS-27, and Engagement Letter EL-06: period lengths
AICPA, SOC 2	The use of a SOC 2 report is restricted to specified parties with sufficient knowledge and understanding of the service organisation's system (Journal of Accountancy, February 2026, an AICPA publication). A SOC 3 report gives an opinion on operating effectiveness without the detailed tests and its use is not restricted (Trust Services Criteria introduction; Journal of Accountancy, 2016). Who may receive a SOC 2 report is for the CPA firm to state, and the report itself says it. A confidentiality agreement is common practice, not an AICPA rule	Questions sheet, AS-24 and AS-25, and Engagement Letter EL-13: who may receive the report, and a SOC 3 report

Editions referenced: AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

This pack does not say which document, record or practice meets a criterion. Each reference says what its source describes and which CISO Times document helps with that work. Using a document does not by itself show that a criterion is met.

Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.