On 14 May 2026 the Journal of Accountancy reported that the AICPA's Peer Review Board had issued a reviewer alert on SOC 2 engagements. It tells reviewers to watch for firms that lean too heavily on third-party SOC platforms and produce engagements with "identical reports, risk assessments, sample sizes, and testing procedures." Reviewers who find that pattern can label the engagements "nonconforming." That is a problem for the CPA firm, and it can become a problem for you if a customer's security team spots a cookie-cutter report.
Founders and CTOs are the ones choosing the auditor, usually under deal pressure. This post turns the alert and the AICPA's earlier commentary into questions you can ask before you sign an engagement letter.
What's affected
Any company buying its first SOC 2 report, or renewing one, from a CPA firm. The alert does not say tools are bad. The AICPA's own Journal of Accountancy piece from 1 February 2026 says the tools can help by pulling evidence automatically instead of collecting screenshots. The concern is professional judgment and tailoring.
Two facts from the sources frame the risk:
- Only a licensed CPA firm can issue a SOC 2 report. Software and referral platforms cannot attest to anything.
- The AICPA's SOC 2 Working Group chair said in February 2026 that "fast and easy" may come at the expense of quality and objectivity, and noted that compliance is a term never used in SOC 2 examinations.
The May 2026 article also lists what a reviewer may do when timelines look unreasonable: dig into the engagement, then possibly conclude it is nonconforming. Follow-up actions for the firm can include outside review of completed engagements.
How to check if you're exposed
You are exposed if your auditor was picked on speed or price alone, or if you cannot answer these:
| Question | What a good answer sounds like |
|---|---|
| Is the firm a licensed CPA firm, and is it enrolled in AICPA peer review? | Yes to both, and they will share the firm's most recent peer review result |
| Who signs the opinion, and who does the testing? | The signing firm's own staff do the work, or they explain exactly how subcontracted staff are supervised |
| Who are the named people on my engagement? | Bios with relevant IT audit experience. One CPA firm's guidance suggests asking for these |
| How will you tailor the risk assessment and sample sizes to my system? | They ask about your architecture, customers and vendors before quoting |
| What is the minimum time from kickoff to report for a Type 2? | A timeline that respects the observation period, then fieldwork, then drafting |
| Do any referral fees or platform relationships exist? | Disclosed plainly |
Read a sample of the firm's reports if they will share redacted ones. If two reports from different clients differ only by logo, you have learned something.
What to do now
- Ask for the firm's license status and peer review enrollment in writing. Keep the answer in your vendor file.
- Ask who is on the engagement team and what experience they have with systems like yours (multi-tenant SaaS, health data, payment flows, AI features).
- Hold a scoping call before you accept a quote. A firm that quotes without asking about your system, vendors and customers has not scoped anything.
- Ask what the tool or platform will and will not do. Evidence collection can be automated. Control design, sampling and testing judgment cannot.
- Ask your customer what they will accept. Some buyers care about firm reputation, a Type 2 length, or specific criteria categories.
- When the draft report arrives, apply the AICPA test: does the report seem tailored to the system, are the controls reflective of the risks in your industry, and are the test procedures appropriate to the controls?
How to avoid this trap
- Do not choose on the shortest promised timeline. A Type 2 cannot be issued until the observation period ends, and one CPA firm describes fieldwork and reporting as usually 4 to 8 weeks after the period closes.
- Do not let a referral platform pick the firm for you. Get at least two firms to scope independently.
- Do not accept a firm that will not name the people doing the work.
- Do not skip the readiness conversation. A good firm's questions during it show you how it will test later.
- Do not treat the report as done when it arrives. Read the exceptions, not just the opinion.
Why it matters
A SOC 2 report is an attestation by a CPA firm. Its value to your buyer is the independence and skepticism behind it. If a customer's reviewer decides the report is boilerplate, you can spend the money and still end up answering the same security questionnaire.
The AICPA is also looking at remedies on its side, including a possible SOC Quality Center described in the February 2026 article. Until something like that exists, your own diligence is the quality check. It costs you a few calls.
Try it yourself
Take the table above and fill it in for the two firms you are comparing. Anything you cannot fill in is a question for the next call.
Click through it at your own pace, or open it full screen.
Quick check
Can a compliance software platform issue a SOC 2 report?
No. Only a licensed CPA firm can issue a SOC 2 report. Platforms can help collect evidence for the CPA firm.
What does "nonconforming engagement" mean in the AICPA alert?
It is a peer review conclusion that an engagement was not performed in accordance with professional standards in all material respects, for example when reports, risk assessments, sample sizes and testing procedures are identical across clients.
Sources
- Journal of Accountancy: AICPA guides peer reviewers to address SOC 2 risks (14 May 2026)
- Journal of Accountancy: Promises of fast and easy threaten SOC credibility (1 February 2026)
- AICPA and CIMA: SOC suite of services
- Linford and Company: What Is SOC 2? (14 October 2026)
- Linford and Company: SOC 2 compliance checklist reality (5 November 2025)
