Who does what for SOC 2? Explained simply
help
The short version
A SOC 2 report is signed by one kind of firm only: a licensed CPA firm. Everyone else in a SOC 2 project helps you get ready for that firm. A consultant finds the gaps and writes what is missing. A software tool collects evidence and tracks the work. Sometimes one firm brings you both, and introduces you to the auditor too.
No AICPA rule stops a consultant or a tool vendor from doing this. The AICPA's rules govern the CPA firm that does the audit. What matters is knowing who signs the report, and that the firm signing it did not build what it is checking.
Who is involved
| Who | What they do | Can they sign the report? |
|---|---|---|
| Your company | Runs the controls, writes and follows the policies, and makes a written statement (the "assertion") that its system description is fairly presented and its controls were suitably designed (and, for a Type 2, operated effectively) | No. You make the claim; the auditor tests it. |
| The CPA firm (service auditor) | Tests your controls against the AICPA's Trust Services Criteria and issues the report with its opinion | Yes. Only a licensed CPA firm can. |
| A readiness consultant | Scopes the audit, finds gaps, writes policies, helps fix controls, gathers evidence | No |
| A compliance tool | Connects to your systems, collects evidence, tracks controls, holds policy templates | No |
| A penetration tester | Tries to break into your systems and reports what it found | No. Optional; see below. |
| Your customer | Asked for the report, and reads it | No |
There is no SOC 2 "certificate", and "SOC 2 compliant" is not a term the AICPA uses. The result is a report, with an auditor's opinion, that your customers read. The AICPA does let a company show its SOC logo for 12 months after a report is issued; the logo is not a certificate.
The auditor
Only a licensed CPA firm can issue a SOC 2 report. You can check a firm's license on CPAverify, a free search run by NASBA (the National Association of State Boards of Accountancy) using license records from 53 participating state and territory boards. If a firm is not listed there, check the board of the state that licensed it.
The auditor cannot build what it audits. Under the AICPA's ethics rules, the firm that examines your SOC 2 cannot set your policies, decide which recommendations you adopt, or take responsibility for designing, implementing or maintaining your controls. The AICPA treats these as threats no safeguard can fix.
An auditor can still give advice and recommendations, as long as your management makes every decision, a named person on your side oversees the work, and the auditor sets out in writing, before it starts, what it will do and what you are responsible for. Some CPA firms offer a limited "readiness assessment" before the audit; these rules mean the assessment has to stop short of doing the work for you.
The consultant
A readiness consultant does the work the auditor must stay out of: drafting your policies, designing your controls, helping you decide what is in scope, and preparing the evidence. Consultants range from one-person practices to large firms, and include virtual CISOs (part-time security leaders) and managed IT providers (MSPs).
A consultant cannot issue the report unless it is itself a licensed CPA firm, and then it cannot audit the work it did for you.
The tool
Compliance automation tools connect to your cloud, code and HR systems, check them against a list of controls, collect evidence for the auditor, and track what is missing. Many include a set of policy templates.
A tool cannot issue the report either. A dashboard that reads 100 percent means the tool's own checks pass; it is not an auditor's opinion.
One firm, three jobs: how it can work now
One firm can bring everything together:
- A consultant brings the tool. Vanta, Drata, Secureframe, Thoropass, Scytale, Hyperproof and Strike Graph each run a partner program for firms that serve clients, such as consultants, virtual CISOs, managed IT providers or resellers. Vanta, Secureframe, Scytale and Hyperproof say on their own sites that partners can resell the software, so the consultant sets it up, runs it for you, and may bill you for it.
- The tool brings the auditor. Most of the same vendors run an auditor network: audit firms that know the tool and work from its evidence. Vanta says more than 100 audit firms partner with it. Drata says it is trusted by more than 175 audit firms, and its guide for audit partners says more than 80 percent of its customers connect with an auditor through Drata.
- Some tools sell the audit itself. Vanta offers a package, which it calls Seamless Audit, in which you choose an auditor from its network (Vanta calls them independent) and the audit fee is built into the platform price. Thoropass performs audits through Thoropass Assurance, which it describes as a licensed CPA firm, and says its readiness and audit teams are kept separate. Comp AI says audit costs are bundled into its subscription.
AICPA ethics staff say these arrangements between tool vendors and audit firms are becoming more common and more formal. The AICPA does not ban them, but its ethics staff list the risks they can create. When your auditor comes from, or is introduced through, the tool vendor's network, a few things are worth checking:
- Who signs the report. The name on the opinion must be a licensed CPA firm. Look it up.
- Who sets the audit fee. AICPA ethics staff say the fee must be set by the auditor, even when it is part of a package.
- Who pays whom. If an auditor pays or receives a referral fee, or receives a commission, connected to your engagement, AICPA rules require it to tell you, in writing.
- Promises about the outcome. A clean opinion cannot be known before the audit is done. AICPA ethics staff have said a guaranteed "clean audit" or "100% pass rate" may be prohibited advertising for a CPA firm.
- What the report says. In May 2026 the AICPA told the peer reviewers who review CPA firms to compare a firm's SOC 2 engagements and check for identical risk assessments, sample sizes or testing procedures from client to client, which it says do not meet professional standards. The AICPA expects each SOC 2 engagement to be tailored to the company being examined.
Templates
From the AICPA. The AICPA publishes the Trust Services Criteria (what the auditor tests against) and the description criteria (what your system description must cover), free with an account. It also publishes illustrative reports, some free and some for members only, and a paid SOC 2 guide. We found no policy templates among the AICPA's SOC 2 materials. The criteria expect policies and procedures, but leave the wording to you.
From the tools. Many compliance automation tools include a library of policy templates: Vanta, Drata, Secureframe, Thoropass, Scytale and Strike Graph all say so on their own sites. Vanta and Scytale describe theirs as auditor-approved. That label is the vendor's own; we found no AICPA program that approves policy templates.
From consultants and publishers. Consultants may bring their own policy sets. Template kits are also sold separately, such as GRC Documents' SOC 2 toolkit, and a few are free, such as StrongDM's open-source Comply.
From government. We found no government SOC 2 template. SOC 2 is not a law or a government program; it is a set of AICPA standards.
A template is a starting point. The auditor checks whether your controls, policies included, meet the criteria and, in a Type 2, whether you actually followed them over the period.
Is a penetration test required?
No. The Trust Services Criteria mention penetration testing only in a "point of focus" (an example) under CC4.1, and the AICPA says the criteria do not require each point of focus to be addressed.
Vendors describe this differently. Strike Graph's own page says penetration testing is not a requirement for SOC 2. Comp AI's cost page lists a penetration test as required annually. The criteria support the first.
Some auditors and customers still ask for a test. It becomes part of the audit only if your own controls, or a customer contract, say you will do one.
Questions to ask
- Which CPA firm will sign our report, and where is its license?
- Is there any referral fee or commission between you, the tool and the auditor?
- If you help us get ready, which parts of the work will you not be allowed to do if you also audit us?
- If we buy the tool through you, who owns the account and the evidence if we leave?
- Which policies come from templates, and who will change them to match how we actually work?
Policy & Compliance is published by AllyMatter, which makes a policy management tool.
What each one is doing here.
Vendors’ own pages, read September 30, 2026
Vanta, service provider partnersVanta, MSP termsVanta, auditor partnersVanta, pricingVanta, Who can perform a SOC 2 auditVanta, SOC 2Drata, channel partnersDrata, Audit AllianceDrata, Audit Alliance program guideDrata, Policy Center overviewSecureframe, service partnersSecureframe, reseller partnersSecureframe, audit partnersSecureframe, pricingThoropass, partnersThoropass, independenceThoropass, SOC 2Scytale, partnersScytale, SOC 2Hyperproof, partner directoryStrike Graph, partnersStrike Graph, SOC 2Strike Graph, penetration testingComp AI, SOC 2 costGRC Documents, SOC 2 toolkitStrongDM, Comply
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.