Choose a SOC 2 auditor by checking that they are a qualified CPA firm, independent from any work they did building your controls, experienced with companies like yours, and able to give a clear timeline, scope and evidence list in writing. Ask what a Type 2 would look like with them next, since you will probably want one.
What does the auditor actually do?
A SOC 2 report is the result of an attestation engagement under AICPA standards, carried out by a practitioner who examines your description of the system and your controls against the Trust Services Criteria. For a Type 1, the report covers design at a point in time and gives no opinion on operating effectiveness. A Type 2 covers a period and includes tests of operating effectiveness.
You do not pick the criteria text, but you do pick which categories are in scope: Security always, and optionally Availability, Confidentiality, Processing Integrity and Privacy. The auditor's view of the right scope will shape cost and effort, so this conversation matters.
Eight questions to ask
1. Are you a licensed CPA firm that performs SOC 2 examinations regularly? Ask how many SOC 2 reports they issue and whether they perform them in house or subcontract.
2. How do you handle independence? If the firm, or an affiliate, helped you design controls or ran your readiness work, ask how they manage independence for the report. Some buyers prefer a clear separation. Ask what the report reader will see.
3. Have you worked with companies of our size and stack? A firm that mostly serves large enterprises may not suit a ten person team on cloud services, and the reverse is also true. Ask for two anonymised examples.
4. What is the scope, timeline and fee structure in writing? We do not quote prices. Ask for a fixed fee for the Type 1, what is excluded, and what triggers a change. Ask when fieldwork starts and how long the report takes after fieldwork ends.
5. What evidence do you want and in what format? Ask for their request list and whether they use a portal. Check that your tools can produce exports they will accept.
6. What is your approach to the description of the system? Management writes the description. Ask whether they review a draft, how many rounds they allow and what they commonly send back.
7. What happens if you find a gap? For a Type 1, a design gap may be fixed before the report date. Ask how late you can fix and still have the control counted.
8. What does a Type 2 look like with you? Ask about observation period length options, how sampling works, and whether they tend to roll forward the same team. Switching firms between Type 1 and Type 2 is possible but costs time.
What about your customers?
Some customers or their procurement teams prefer certain firms or ask for a particular category. Ask your three biggest prospects what they expect, and check whether a smaller firm's report is acceptable to them.
Red flags
- A promise that you will pass. Auditors give opinions after examination, not guarantees.
- No sample report or no written scope.
- Pressure to buy their tooling or consulting bundle as a condition of the audit.
- Evasive answers on independence.
What to do
- Decide your categories and target report date.
- Ask your key customers about expectations.
- Request proposals from at least three firms using the eight questions.
- Compare scope, independence, evidence format and timeline side by side.
- Check two references per firm.
- Sign an engagement letter that states scope, the point in time date and the deliverable.
- Share your gap list early so surprises come before fieldwork.
Quick check
Can the same firm that helped us prepare also issue the report?
It depends on the firm's independence rules and what the preparation involved. Ask them to explain in writing, and ask what the report will disclose.
Do we need a Type 1 before a Type 2?
No rule requires it. Many teams use Type 1 as a first deliverable while the Type 2 observation period runs.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so the evidence your auditor asks for can be collected from connected systems and code instead of screenshots, and kept ready between audits. That shortens the back and forth in fieldwork and gives your team time for other work. Technical evidence comes from your real code and dependencies. Safeguard does not replace the auditor, does not issue reports and cannot guarantee a pass. It helps you prepare and keep evidence ready for the independent third party you choose. Book a call.
Sources
- AICPA, Trust Services Criteria (2017, with 2022 points of focus): introductory text on attestation engagements, the practitioner, and Type 1 and Type 2 reports, paraphrased.
Last reviewed: 18 October 2026.
