Track: Buying a platform · Lesson 6 of 10
How to choose a SOC 2 auditor, and what the platform's audit path changes
Short answer
Only a licensed CPA firm can issue a SOC 2 report. Before you sign, ask whether the firm is enrolled in AICPA peer review and how independent it is from your compliance software vendor. Platforms then offer three paths: an in-house audit, a partner auditor network, or bringing your own auditor.
By the SOC 2 Vendor Compare ledger desk · Published 2026-05-19 · Reviewed 2026-09-29 · Editorial assessment
What should you ask any SOC 2 auditor?
Ask whether the firm is a licensed CPA firm enrolled in AICPA peer review. Ask who will perform the fieldwork and how much of it is done by the firm's own staff. Ask how the firm is paid and whether it has any business arrangement with your compliance software vendor. In April 2026 AICPA ethics staff published guidance titled 'Business arrangements with SOC tool providers', which is a useful prompt for that last question.
What are the three audit paths?
In-house audit: the platform vendor also provides the audit, as Thoropass describes. Partner network: the vendor connects you to auditors it works with, as Scytale (Built-In Audit with partner auditors), Vanta (its Audit product, with a stated 26k audits completed with AICPA peer-reviewed auditors), Secureframe (Audit Partner Network), Sprinto (network auditor access) and Drata (auditors in its partner network) describe. Bring your own auditor: you contract the firm yourself and give it access to the platform; Sprinto lists this explicitly as BYOA, and Scytale says it manages the audit process with your chosen auditor.
Source: Thoropass homepage · read 2026-09-29
Source: Scytale audit management · read 2026-09-29
Source: Vanta for startups · read 2026-09-29
Source: Secureframe pricing · read 2026-09-29
Source: Sprinto pricing · read 2026-09-29
Source: Drata partners · read 2026-09-29
How does the path change the work?
With an in-house or partner auditor, scheduling and evidence handover are usually simpler, because the auditor already knows the platform. With your own auditor, you keep full choice of firm, which matters if a customer has named a firm or you already have a relationship. Either way, the CPA firm, not the software, forms the opinion.
What did the profession publish on SOC 2 in 2026?
The Journal of Accountancy and the AICPA published several items on SOC 2 quality this year, including 'Promises of fast and easy threaten SOC credibility' (2026-02-01), the ethics guidance above (2026-04-13) and 'AICPA guides peer reviewers to address SOC 2 risks' (2026-05-14). Read them as background on what a careful audit looks like.
How do we score the audit path?
Our audit path criterion scores how clearly each vendor describes the route from readiness to report. Thoropass scores highest because audit and automation sit in one company; see the rankings for the full column.