The short answer
- Who writes the report: an independent CPA firm. SOC services are provided by CPAs, and the AICPA, the US body for CPAs, sets the professional standards for SOC engagements.
- What a platform does: it connects to your tools, collects evidence (the proof an auditor asks for), tracks your controls and gives your auditor a view of the evidence.
- Three setups: your own auditor, a platform's auditor network, or software and audit from one company group.
- What to ask any firm: whether it is a licensed CPA firm, whether it is enrolled in AICPA peer review (a check of the firm's own work) and whether your buyer accepts its report.
Who is this guide for?
This guide is for founders at seed to Series B startups who are buying a SOC 2 report for the first time and want to know who actually signs it. It is part of our guide to buying compliance software, which compares 11 platforms. It explains the roles. It does not rank or recommend audit firms, and it is not legal or audit advice.
What is a SOC 2 report, and who writes it?
A SOC 2 report is a report on the controls a company has for security and for protecting customer data. A control is a rule your company follows and can prove, such as "new staff get security training". The report can cover five categories: security, availability, processing integrity, confidentiality and privacy. You and your buyer choose which are in scope.
A licensed CPA firm writes it. CPA stands for certified public accountant. The AICPA is the US body for CPAs, and it sets the professional standards for SOC engagements. A report includes management's description of your system, management's assertion about it and the CPA firm's report on your controls.
SOC 2 reports come in two kinds, called Type I and Type II. A Type I report looks at your controls on one date. A Type II report looks at how they work over a period. Your buyer will say which one it wants, so ask your buyer first.
What does a compliance platform do, and what does the CPA firm do?
The software and the audit firm do different jobs. This table splits them.
| Job | Who does it |
|---|---|
| Connect to your tools and collect evidence (the proof an auditor asks for) | The platform |
| Track your controls and policies | The platform |
| Give your auditor a view of the evidence | The platform. Some platforms do this through an Auditor API |
| Test your controls | The CPA firm |
| Write and issue the SOC 2 report | The CPA firm |
| Set the price | The platform sets the software price. The CPA firm sets its own audit fee |
What is a platform's audit arm?
Some platform companies sit in the same group as a CPA firm. The CPA firm is a separate company with its own licence, and it is the one that tests your controls and issues the report. Thoropass is an example: its audit arm, Thoropass Assurance, is a licensed certified public accounting firm. When you buy from a group like this, you buy software and an audit from one place, and you can still ask for each price on its own.
What are the three ways to get an auditor?
What differs between platforms is how you reach the CPA firm. These three cards cover the setups.
Your own auditor
- Ask the platform which auditors already work with it.
- Get quotes from two or three firms.
The platform's auditor network
- Ask what the audit firm charges and who invoices you.
Software and audit from one company group
- Ask for the software and audit prices together.
Which platform works which way?
| Platform | How you reach an auditor |
|---|---|
| Vanta | Access to Vanta's auditor network, or bring your own auditor |
| Secureframe | The Secureframe Audit Partner Network, on Fundamentals and Complete |
| Sprinto | Network auditors on Foundation; bring your own auditor on Growth |
| Strike Graph | Works with any auditor and can connect you with independent auditors. It also sells its own assessment and audit services for approved certifications, at $4,000 to $8,000 a year depending on the plan |
| Comp AI | Works with any accredited auditor you choose; the independent auditor conducts the audit and produces the report |
| Oneleet | Audit support is in the flat fee; the independent auditor signs your report |
| Thoropass | Its audit arm, Thoropass Assurance, is a licensed certified public accounting firm, so the software and the audit come from one company group |
| Drata | Ask in the demo |
Setups can change by plan. Ask the company which auditor options your plan includes.
How do you choose an audit firm?
Whichever setup you pick, put the same questions to every firm.
- Is it a licensed CPA firm in the place where you operate?
- Is it enrolled in AICPA peer review (a check of the firm's own audit work)?
- Has it done SOC audits for companies of your size and type?
- Does your buyer accept its report?
- What does it quote for the audit, in writing, and what does the quote include?
- Which Type of report and which categories will it cover?
Frequently asked questions
Who signs a SOC 2 report?
A licensed CPA firm signs it. SOC services are provided by CPAs, and the AICPA sets the professional standards for SOC engagements. Your software platform does not sign the report.
Can a software platform issue a SOC 2 report?
No. A platform connects to your tools, collects evidence and tracks your controls. A CPA firm tests your controls and issues the report. Some platform groups include a CPA firm, which is a separate company with its own licence.
Can my platform also be my auditor?
In one setup, yes. Thoropass is a platform whose audit arm, Thoropass Assurance, is a licensed certified public accounting firm, so the software and the audit come from one company group. Most other platforms work with auditors they connect you with, or with your own.
Do I have to use the auditor my platform recommends?
Vanta lets you bring your own auditor, and Sprinto offers bring your own auditor on its Growth plan. Strike Graph and Comp AI work with any accredited auditor. Ask every platform which setups it allows before you sign.
What does a SOC 2 report contain?
It holds management's description of your system, management's assertion about it and the CPA firm's report on your controls. Your auditor can walk you through a sample before you start.
Is SOC 2 a certification?
No. SOC 2 is a report from a CPA firm. ISO 27001 is the one with a certificate, which an independent certification body issues.
Can you fail a SOC 2 audit?
A SOC 2 report is not a score. It holds the auditor's report on your controls and the test results. Ask your auditor before you start what happens if a control does not work, and how findings are handled.
Who are the top 10 SOC 2 auditors?
This guide does not name or compare audit firms. Choose a firm by whether it is a licensed CPA firm, whether it is enrolled in AICPA peer review, whether it has done SOC audits for companies like yours, what it quotes in writing and whether your buyer accepts its report.
What is AICPA peer review?
Peer review is a check of a CPA firm's own audit work by another firm. Ask any audit firm whether it is enrolled.
The short version
- Who signs the report: a licensed CPA firm.
- Who collects the proof: your platform.
- Your options: your own auditor, the platform's network, or software and audit from one company group.
- What to ask any firm: licence, AICPA peer review, experience, buyer acceptance and a written quote.
Ask each platform which auditor setups its plan includes, and ask for the software and audit prices together.
Best for your situation
Guides & comparisons
Prices are as of 20 October 2026 and can change.
Add us as a preferred source on Google, and our reviews and picks show up in your Top Stories and AI Overviews.
