What a SOC 2 CPA does
A SOC 2 auditor examines your controls against the AICPA’s Trust Services Criteria: security, plus any of availability, processing integrity, confidentiality and privacy that you include in scope.
The auditor helps you set scope and the report period, tests controls, and issues a Type 1 report on design or a Type 2 report that also covers operating effectiveness over a period. The report is an attestation engagement performed under AICPA standards, which is why it must come from a licensed CPA firm. See our SOC 2 audit page.
Readiness consultants and compliance software can help you prepare and collect evidence. They cannot issue the report.
How to verify a SOC 2 auditor’s license
- License. Search the firm and the signing partner on NASBA CPAverify or through NASBA’s state board directory.
- Peer review. Firms that perform attest work, including SOC examinations, must be peer reviewed. Look up the latest report in the AICPA Peer Review public file.
- The name on the report. Make sure the firm signing the opinion is the licensed firm you checked, not a platform, reseller or brand name.
- AICPA notices. The AICPA’s SOC 2 page says it refers unlicensed firms and practitioners offering SOC services to state boards of accountancy.
Questions to ask a SOC 2 auditor before hiring
- Is your firm licensed, and may we see your latest peer review report?
- Who on the engagement holds a CPA license, and who signs the report?
- How many SOC 2 Type 2 reports did you issue last year for companies like ours?
- Did your firm or an affiliate help design or operate our controls?
- How do you collect evidence through our compliance software, and what do you test yourselves?
- What is the timeline from period end to the final report?
Free checklist
SOC 2 Auditor Due-Diligence Checklist
Red flags
- Talk of “SOC 2 certification” rather than an examination report.
- A clean report is promised before scoping or testing starts.
- The report is signed by a non-CPA entity, or you cannot find the firm on CPAverify.
- The same party built your controls and now audits them.
- Very short timelines with little evidence requested, which may signal thin testing.
Why clients choose Your Virtual CPA
- A licensed CPA firm performing SOC examinations nationwide, virtually.
- SOC 2, SOC 1 and SOC for Cybersecurity engagements, plus SOC 2 for nonprofits.
- Transparent fees quoted upfront, in writing.
- A free initial consultation before any work starts.
How it works with us
Best for: SaaS, cloud and service companies that need a first SOC 2 report or a new auditor.
- Free initial consultation. Tell us what customers are asking for, your systems and your deadline.
- Fees quoted upfront, in writing. An engagement letter with scope, criteria and period.
- Scoping. We confirm systems, criteria and Type 1 or Type 2.
- Testing. Evidence requests and walkthroughs, done virtually.
- Report. Your SOC 2 report, ready to share with customers under your terms.
Compliance platform vs readiness consultant vs licensed CPA firm
| Compliance software platform | Readiness consultant | Licensed CPA firm (auditor) | |
|---|---|---|---|
| Collects evidence and tracks controls | Yes | Sometimes | Reviews and tests it |
| Helps design controls and policies | Templates | Yes | No (independence) |
| Tests controls independently | No | No | Yes |
| Issues the SOC 2 report | No | No | Yes |
| Licensed and peer reviewed | No | Not required | Required |
Expert CPAs. Personal attention.
A customer asking for your SOC 2 report? Bring the request and your systems list to a free initial consultation and talk to a CPA.
Frequently asked questions
A licensed CPA firm. A SOC 2 report is an attestation engagement performed under AICPA standards, and state boards of accountancy regulate who may issue attest reports. The AICPA says it refers unlicensed firms and practitioners offering SOC services to state boards. Consultants and software platforms can help you prepare, but they cannot issue the report.
No. SOC 2 is a CPA’s examination report with an opinion on your controls, not a certificate. Treat “SOC 2 certified” marketing language with caution and ask who actually signs the report.
Look up the CPA firm on NASBA CPAverify or the state board, and find its latest peer review report in the AICPA Peer Review public file. Confirm that the firm named on the report is the licensed firm, not a platform or reseller.
Be careful. An auditor must be independent of the controls it examines. If the firm, or an affiliate, designed or runs your controls, ask how independence is preserved. Many companies use one party for readiness and a separate CPA firm for the audit.
A Type 1 report covers the design of controls at a point in time. A Type 2 report also tests whether controls operated effectively over a period. Customers often ask for a Type 2.
SOC 1 covers controls relevant to your customers’ financial reporting, such as payroll or billing processing. SOC 2 covers controls related to security and the other Trust Services Criteria. Some service organizations need both.
Yes. Your Virtual CPA is a licensed CPA firm that performs SOC examinations nationwide. Most SOC 2 evidence is electronic, so the work is done virtually.
It depends on scope, the criteria included, Type 1 or Type 2, and the number of systems. We quote fees upfront, in writing, after a free initial consultation.
Sources
- AICPA: SOC 2 (audit and assurance)
- AICPA: SOC suite of services
- AICPA Peer Review public file search
- NASBA CPAverify
- NASBA: State boards of accountancy
General information as of October 20, 2026. Tax rules change; talk to a CPA about your situation.