The AICPA and the Journal of Accountancy on SOC 2 in 2026: a dated reading list

What was published, and when?

• 2026-02-01 · Journal of Accountancy · 'Promises of fast and easy threaten SOC credibility'
• 2026-04-13 · AICPA Ethics Staff Insights · 'Business arrangements with SOC tool providers'
• 2026-04-30 · Journal of Accountancy podcast · 'The risks of quick-turn SOC engagements and what CPAs should know'
• 2026-05-14 · Journal of Accountancy · 'AICPA guides peer reviewers to address SOC 2 risks'

This post covers items published from February to May 2026. We list titles and dates from the AICPA's SOC suite page; read the items themselves for their full content.

Source: AICPA SOC suite of services · read 2026-09-29

Why does this matter to a software buyer?

A SOC 2 report is only as useful as the examination behind it. Your customers read the report because a licensed CPA firm examined your controls. The AICPA describes SOC as a suite of services CPAs may provide. The titles above show the profession paying attention to speed promises, to peer review of SOC 2 work and to the arrangements between audit firms and tool vendors.

Question 1: is the auditor a licensed CPA firm enrolled in peer review?

Only a CPA firm can issue a SOC 2 report. Ask for the firm's name, confirm it is licensed and ask whether it is enrolled in AICPA peer review. Do this whether the auditor comes from your platform vendor's network, from the vendor itself or from your own search.

Question 2: how independent is the auditor from the tool vendor?

Many compliance platforms introduce auditors from a partner network, and some vendors perform audits themselves. None of these models is wrong in itself. Ask how the firm is paid, whether it has a business arrangement with the vendor, and who performs the fieldwork. The April 2026 ethics item is titled for exactly this subject.

What should you do with speed promises?

Treat any promised timeline as a vendor claim. Ask what the timeline assumes (report type, scope, readiness at the start) and ask the auditor, not the software vendor, how long fieldwork takes. Our scores do not reward speed claims; see the methodology.

Where can you read more on this site?

How to choose a SOC 2 auditor, and what the platform's audit path changes covers the audit paths in more detail, and the news page lists these items with other dated entries.

What does peer review mean in practice?

Peer review is the AICPA program under which a CPA firm's accounting and auditing practice is reviewed by another firm. The 2026-05-14 Journal of Accountancy item is titled for the AICPA guiding peer reviewers to address SOC 2 risks. For a buyer, the practical step is simple: ask the audit firm whether it is enrolled and when its last review took place.