A-LIGN

Is A-LIGN a licensed CPA firm?

Yes. Price and Associates CPAs, LLC, doing business as A-LIGN ASSURANCE, is the licensed CPA firm that issues SOC reports and is PCAOB-registered. A-LIGN Compliance and Security, Inc., doing business as A-LIGN, is the cybersecurity and compliance services company.

A-LIGN’s own SOC 2 page, reviewed 20 August 2026, still leads with the firm claim that it is the world’s #1 SOC 2 issuer.

That legal split settles whether A-LIGN is a licensed SOC 2 auditor. The services company and the CPA firm share a brand; the signature on the report should name the CPA entity. A-LIGN was founded in 2009 by Scott Price in Tampa. Hg took a majority stake in A-LIGN in July 2025. Scott Price remains Founder and CEO; Steve Simmons became President in January 2026.

What volume does A-LIGN actually publish?

On 20 August 2026 A-LIGN’s SOC 2 page published 13.8k+ SOC 2 audits, 200+ SOC auditors, 96% satisfaction, plus 36k+ audits, 6.4k+ clients, and 400+ auditors. Those are the firm’s numbers, not an independent census.

The “#1 issuer” line is A-LIGN’s own ranking claim.

Earlier A-LIGN materials cited 5,700+ clients and 31,000+ audits; the August 2026 figures above are the current ones. A-LIGN appeared on the Inc. 5000 for nine consecutive years (2017-2025), including #4344 in 2024 with 98% three-year revenue growth (2020-2023).

What is A-SCEND, including EvidenceIQ and Cross-Service?

A-SCEND is A-LIGN’s proprietary audit platform: evidence requests, auditor chat, and cross-framework mapping live in one system, and A-LIGN says clients can keep their GRC tool. In September 2025 it received FedRAMP 20x Low authorization. In March 2026 A-LIGN added EvidenceIQ (AI evidence scoring) and Cross-Service (reuse across frameworks).

A-LIGN says the FedRAMP 20x Low authorization makes it one of the only top-tier 3PAOs with a FedRAMP-authorized audit management platform. On 5 November 2026 the FedRAMP Marketplace listed A-SCEND at Class B (Low). In March 2026, A-LIGN launched two new capabilities within A-SCEND: EvidenceIQ (AI-powered evidence evaluation with request-level scoring) and Cross-Service (cross-framework evidence reuse). Steve Cochran, formerly of ConnectWise, joined as Strategic Advisor alongside that release.

Core Platform Capabilities:

De-Duplication Engine

“Most companies have multiple compliance standards they have to adhere to. Our software de-duplicates the requests, so there’s only one request for multiple standards. We test one time and can produce many reports.” (Scott Price, Founder & CEO, A-LIGN)

A-LIGN says this means a client needing SOC 2, ISO 27001, and HITRUST does not answer the same control questions three times: A-SCEND maps once and generates multiple reports from a single evidence collection process.

Real-Time Auditor Feedback

A-LIGN says A-SCEND gives auditor feedback during evidence collection, not only at the end of the engagement.

Workflow Delegation & Global Collaboration

A-LIGN says A-SCEND lets clients delegate data gathering globally down to specific individuals and approve data before auditors see it.

Proximity Visibility

A-LIGN says the platform shows how close you are to fulfilling additional standards you may want to audit against in the future (e.g., “You’re 75% ready for ISO 27001”).

Intuitive Interface

One anonymous client review praises the platform’s user experience: “As easy as a SOC 2 audit could possibly be!”

What audits does A-LIGN actually sell?

A-LIGN’s SOC menu is SOC 1, SOC 2 Type 1 and Type 2, and ISAE 3000. Beyond SOC it sells ISO 27001/27701/42001, HITRUST, PCI DSS, FedRAMP, CMMC (C3PAO since January 2021 on the firm’s account), pentesting, and privacy/risk assessments. Readiness is an assessment, not the attest report.

SOC Attestations:

• SOC 1 (financial service organization controls)
• SOC 2 Type 1 (point-in-time design assessment)
• SOC 2 Type 2 (3-12 month operational effectiveness)
• ISAE 3000 (international standard integrated with SOC for global customers)

SOC 2 Readiness Assessment:

A-LIGN’s readiness assessment evaluates an organization’s controls, identifies gaps, and leaves time to remediate before the official audit. A-LIGN says it is designed for first-time SOC seekers to “bridge knowledge gaps, understand how controls are evaluated, and grasp how SOC attestation impacts the broader business.”

Beyond SOC:

• ISO 27001/27701/42001
• HITRUST CSF
• PCI DSS
• FedRAMP
• CMMC (C3PAO Authorized since January 2021)
• Penetration Testing
• Privacy & Risk Assessments

How does an A-LIGN SOC 2 engagement actually run?

A-LIGN sells a consultative path: optional readiness, then Type 1 or Type 2 testing inside A-SCEND, with auditor feedback during evidence collection rather than only at the end. Type 2 observation is typically 3–12 months on A-LIGN’s SOC page. The CPA firm still issues the report; readiness does not replace attestation.

What that path includes:

✓ Readiness assessments for first-time SOC seekers ✓ Educational materials to help companies understand compliance impact on business ✓ Process improvement recommendations over pure gap identification ✓ Partnership mindset: setting clients up for success without compromising the integrity of the resulting reports

From client feedback:

“Earning our SOC 2 report has greatly impacted this conversation and allows us to establish a sense of trust and maturity… has given Raindrop the ability to take our business to the next level and secure more customers.”, Ward Karson, COO, Raindrop

What do clients say about A-LIGN?

Reviews on this page (Jitterbit, Nasdaq, and an anonymous A-SCEND user) stress a usable portal, responsive auditors, and an educational tone.

1. Customer service

“Exceptional security auditor. Proactive approach and excellent customer service.”, Will Au, Jitterbit

“Professional, responsive, and continuously works with our Nasdaq team to improve our processes over each audit cycle.” (Amrik Johal, Nasdaq)

2. Platform experience

“The A-SCEND system is intuitive and comprehensive. It makes preparing for our SOC audit less daunting.”

3. Educational value

“Straightforward and educational”, Will Au, VP Engineering, Jitterbit

Who is A-LIGN a good fit for?

A-LIGN fits teams that need SOC 2 now and ISO, HITRUST, or PCI next, and that will actually use A-SCEND rather than fight a portal. It is a poor fit when the report has to carry a Big Four name or when you want a boutique, email-only auditor.

Best Fit For:

• Companies needing multiple compliance frameworks (SOC 2, ISO 27001, HITRUST, PCI) where A-SCEND’s de-duplication reduces duplicate work
• First-time audit seekers wanting an educational, consultative approach
• Technology-enabled companies prioritizing platform-driven audits over traditional relationship-based approaches
• Global companies requiring both U.S. and international standards (ISAE 3000 capability)
• Organizations planning future certifications: A-SCEND’s proximity visibility shows how close they are to other standards

Not Ideal For:

• Companies wanting Big 4 brand prestige for IPO/investor optics
• Organizations requiring highly specialized niche frameworks (A-LIGN is broad, not ultra-specialized)
• Companies uncomfortable with platform-driven audits who prefer traditional hands-on approaches
• Price-sensitive startups wanting absolute lowest cost (our estimates put Type 2 at $15,000–$50,000)

How big is A-LIGN, and who owns it?

Hg took a majority stake in A-LIGN in July 2025; Scott Price remains founder and CEO. Current SOC-page volume is 13.8k+ SOC 2 audits and 6.4k+ clients. Treat “#1 issuer” as A-LIGN’s claim.

Scale:

• #1 issuer of SOC 2 reports globally (A-LIGN’s own claim)
• 400+ auditors (firm-stated)
• 6.4k+ clients and 36k+ audits completed (firm-stated, August 2026)
• 20+ years industry experience (founder Scott Price)

Ownership:

• Backed by Hg, which took a majority stake in July 2025; A-LIGN opened a London office in 2026

Growth:

• 98% three-year revenue growth (2020-2023), per Inc. 5000 2024
• Inc. 5000 #4344 (2024); nine consecutive years on the list (2017-2025)
• Platform investment includes FedRAMP 20x Low authorization for A-SCEND

What is actually different about A-LIGN?

The durable difference is A-SCEND’s “test once, produce many reports” mapping, which A-LIGN says lets one evidence set feed SOC, ISO, HITRUST, and HIPAA reports, plus EvidenceIQ scoring added in March 2026. Hg ownership does not replace the CPA signature.

2. Published Client Volume

A-LIGN’s SOC 2 page lists 6.4k+ clients as of 20 August 2026. That is a firm-stated number.

3. International Capability

A-LIGN offers ISAE 3000 engagements. Companies expanding globally can maintain a single auditor relationship rather than a U.S. auditor plus an international auditor.

4. Education focus

A-LIGN says it emphasizes education and partnership over checklist compliance, which suits first-time audit seekers.

5. Hg Backing and European Expansion

Hg took a majority stake in A-LIGN in July 2025. A-LIGN opened a London office in 2026.

How much does an A-LIGN SOC 2 cost, and how long does it take?

A-LIGN does not publish a rate card. Our estimates remain $10,000–$20,000 Type 1 and $15,000–$50,000 Type 2, with a 3–12 month Type 2 observation window on A-LIGN’s own SOC page. A 2025 anonymous forum comment of about $12k for a small SaaS engagement is one data point, not a list price.

Pricing Range (Estimated):

A-LIGN does not publish pricing. Our estimates:

• SOC 2 Type 1: $10,000 - $20,000
• SOC 2 Type 2 (3-month window): $15,000 - $30,000
• SOC 2 Type 2 (6-12 month window): $25,000 - $50,000

Timeline (as A-LIGN states it):

• Type 1: usually 2-4 weeks
• Type 2 observation period: 3-12 months on A-LIGN’s SOC 2 page
• Fieldwork: 2-6 weeks
• Report delivery: draft within 3 weeks of fieldwork ending; final report 1-2 weeks after the draft is approved

What should a buyer watch for?

A-SCEND is the advantage and the dependency: if you will not live in that portal, the multi-framework pitch weakens. A-LIGN says A-SCEND is included with applicable frameworks rather than sold as a separate platform fee, and that a client already on Vanta, Drata or Secureframe does not have to give it up. As of November 2026 the A-SCEND FAQ says the Vanta integration is live and the Drata integration is in progress, so if you run any tool other than Vanta, ask how its evidence reaches A-SCEND. There is still no public rate card.

Strengths:

✓ Scale - 6.4k+ clients (firm-stated, August 2026) ✓ Platform - A-SCEND de-duplicates evidence requests across frameworks; FedRAMP 20x Low authorized ✓ Financial backing - Hg majority stake (July 2025); London office opened 2026 ✓ Multi-framework coverage - SOC 2, ISO, and HITRUST work can share one evidence set

Potential Considerations:

• Scale vs. personalization - In our view, a firm with 6.4k+ clients (firm-stated) is less likely to offer boutique-level personal attention
• No public pricing - Creates buyer friction requiring sales calls/quotes

When should a buyer shortlist A-LIGN?

Compare Schellman if federal or classified work dominates, and Coalfire if FedRAMP High plus a native assessment platform is the constraint. A-LIGN ASSURANCE still has to be the signer, and A-SCEND only pays off if the team will actually live in that portal.

For companies needing SOC 2 today, ISO 27001 next quarter, and HITRUST next year, A-LIGN says its “test once, produce many reports” model reduces duplicate audit work. The readiness assessments suit first-time audit seekers who want guidance.

The 400+ auditors and 6.4k+ client base (both firm-stated) and Hg’s majority stake describe a scaled operation rather than a boutique, with a London office opened in 2026.

A-LIGN is built for private mid-market companies with multi-framework compliance needs, not public companies requiring Big 4 prestige or organizations wanting boutique personalization.