Barnes Dennig

Who is Barnes Dennig?

Barnes Dennig is an independent, employee-owned U.S.-based CPA and advisory firm founded in 1965 by Bob Barnes and Al Dennig, headquartered in Cincinnati, Ohio. Being employee-owned means no outside investor or parent firm sits behind the audit opinion.

Effective January 1, 2025, the firm merged with Indianapolis-based Greenwalt CPAs (founded 1945), creating one combined firm operating under the Barnes Dennig name. The combined firm now has roughly 225 employees across five offices in three states: Cincinnati and Dayton (Ohio), Crestview Hills (Kentucky), and two locations in Indianapolis (Indiana).

The firm celebrated its 60th anniversary in 2025 and is recognized as a Top 200 Inside Public Accounting “Best of the Best” firm. Jay Rammes has served as Managing Director since 2018 and continues to lead the combined firm post-merger.

For SOC-specific work, approximately 20 people focus exclusively on SOC reports, and the firm says readiness, fieldwork, audit, and report issuance are handled entirely in-house, with no portion of the engagement outsourced. The SOC team is distributed across six time zones, and the firm says it serves clients from two-person startups to large multinationals. Their public materials show SOC clients in the United States as well as New Zealand, Europe, and the Philippines.

The firm is in good standing with the AICPA Peer Review Program, the independent CPA-firm-on-CPA-firm review of compliance with professional standards. Buyers running third-party risk reviews or vendor due diligence can use peer review status as one input.

Who leads the Barnes Dennig SOC practice?

Robert J. Ramsay (CPA, CISA, CITP) leads Barnes Dennig’s Risk Management and SOC Reporting practice. He is an AICPA-designated SOC specialist and an instructor for the AICPA SOC School.

Ramsay is:

• An AICPA-designated SOC specialist, a credential that allows him to serve as a quality control inspector for other firms’ SOC reports nationally
• An instructor for the AICPA’s SOC School, training other firms on planning, executing, and reporting on SOC engagements
• A Certified Common Security Framework (CSF) Practitioner through the HITRUST Academy
• The author of the first HMIS attestation guide
• 22+ years of experience in technology audits and SOC reporting; 15+ years of helping organizations strengthen internal controls
• Former president of the Cincinnati ISACA chapter; frequent presenter for AICPA and ISACA

Other named members of the SOC team include:

• Bryan Gayhart (CPA, CISA, HITRUST CCSFP), Director, SOC Reporting
• Morgan Ryle (CPA), Director, SOC Reporting
• Cheryl Ganim, SOC Reporting team
• Myles Wallace, SOC Reporting (author of public SOC 2 Plus guidance)

How does a Barnes Dennig engagement work?

Barnes Dennig positions itself away from transactional, checkbox-style audits. It describes its emphasis as quality of work and long-term client relationships: clients who stay across multiple report cycles, framework expansions, and growth stages, rather than one-off engagements driven purely by procurement.

Two specifics follow:

1. No outsourcing. The firm says the full scope of every SOC engagement (readiness through report issuance) is handled by Barnes Dennig employees, with no subcontractors and no white-labeled deliverables.
2. Same-team continuity. Public client testimonials repeatedly name the same auditors (Ramsay, Gayhart, Ryle, Ganim) over multi-year engagements.

What should buyers know about Multi-Framework Coverage and SOC 2 Plus?

SOC 2 is the core of the practice, but the same team handles a broad set of adjacent frameworks, including SOC 2+ reports that bundle multiple framework attestations into a single AICPA-backed deliverable.

SOC reports

• SOC 1 Type 1 and Type 2 (financial reporting controls / SSAE 18)
• SOC 2 Type 1 and Type 2 (Security, Availability, Confidentiality, Processing Integrity, Privacy)
• SOC 3 (public-facing summary report)

SOC 2+ extended frameworks

A single SOC 2+ report can include any of the following alongside the AICPA Trust Services Criteria:

• ISO/IEC 27001 (Information Security Management)
• ISO 42001 (AI management systems)
• HITRUST CSF (mapped to HIPAA)
• NIST 800-53 and NIST CSF
• HIPAA
• GDPR
• PCI DSS
• CSA Cloud Controls Matrix
• ISACA Blockchain Framework
• Germany’s C5 (Cloud Computing Compliance Controls Catalog)
• ISAE 3000 / ISAE 3402 (international assurance standards for non-US customer requirements)

AI compliance: SOC 2 + ISO 42001

Barnes Dennig has built a productized SOC 2 + ISO 42001 offering for organizations whose products or services touch AI. ISO 42001 is the first international standard for managing AI, covering ethics, transparency, accountability, and risk management across the AI lifecycle. Barnes Dennig lists SOC 2 + ISO 42001 as a named service line on its website.

For multi-framework buyers, the practical value of the SOC 2+ approach is consolidating multiple attestations into one audit, one fieldwork window, and one report, rather than running parallel SOC 2 and ISO 27001 engagements with two separate firms.

Which industries does Barnes Dennig actually serve?

The SOC practice focuses on healthcare, financial services, and technology companies that need a regional CPA with HITRUST fluency. National buyers should still confirm bench depth for their scope.

Industries the SOC practice specifically focuses on:

• Healthcare (including HITRUST and HIPAA)
• FinTech and financial services
• Banking
• Revenue management and collections (TPAs)
• Workers’ compensation and self-insured entities
• Cloud-based software vendors / SaaS
• Data centers
• AI / emerging technology (via ISO 42001)

The Barnes Dennig website lists roughly 12–15 industries.

How much does a Barnes Dennig SOC 2 audit cost?

By our estimates, a SOC 2 Type 1 runs $10,000 to $25,000 and a Type 2 $15,000 to $40,000. Barnes Dennig does not publish prices, so confirm the fee basis in its proposal. Final pricing depends on:

• Risk profile of the entity being audited
• Complexity of the control environment
• Size of the environment in scope
• Adherence to timeline: clients who keep evidence flowing on schedule reduce overall cost

How fast can Barnes Dennig start a SOC 2?

Barnes Dennig says it is able to start engagements immediately. For companies with an external deadline driven by enterprise sales, vendor reviews, funding, or a customer contract clause, a start date can decide between firms that otherwise look similar on paper.

What trust signals does Barnes Dennig publish?

Check AICPA peer-review standing, Ramsay’s AICPA SOC School instructor role, and Inside Public Accounting Top 200 placement before you treat them as current. Those are public signals, not a substitute for the engagement letter.

• AICPA Peer Review Program: good standing. Standard CPA-on-CPA quality review.

• AICPA SOC School instructor (Robert Ramsay). Trains other firms; serves as quality control inspector for other firms’ SOC reports.

• Top 200 Inside Public Accounting firm; recognized as “Best of the Best.”

• 60+ year operating history (founded 1965; 60th anniversary in 2025).

• HITRUST Academy participation, including the CSF Practitioner credential.

• AICPA and ISACA active membership and presenting.

Who is Barnes Dennig a good fit for?

Barnes Dennig fits companies that want SOC 2 plus ISO, HITRUST, HIPAA, or PCI from one regional CPA team, including AI products adding ISO 42001.

• Companies pursuing SOC 2 alongside one or more additional frameworks (ISO 27001, ISO 42001, HITRUST, NIST, HIPAA, PCI) who want a single audit team consolidating the work into a SOC 2+ report rather than running parallel engagements.

• AI-touching products that want a standard security attestation (SOC 2) and ISO 42001 readiness from the same team.

• Healthcare, FinTech, financial services, TPA / collections, and self-insured / workers’ comp organizations where the SOC team has direct vertical experience.

• Companies on a tight external deadline, since the firm says it can start immediately.

• Buyers who want a long-term audit relationship (same partners, same team, multi-year continuity) rather than a transactional, one-off checkbox engagement.

• International companies needing US SOC reports plus ISAE 3000 / 3402 or C5 to satisfy non-US customer requirements.

When is Barnes Dennig not the right fit?

Skip Barnes Dennig if you need FedRAMP 3PAO or CMMC C3PAO, a Big Four name, or the cheapest single-framework boutique price. Those are outside the current mix or the regional-CPA cost band.

• Defense / classified work requiring FedRAMP 3PAO authorization or CMMC C3PAO assessment status. Neither is part of the current service mix.

• Pure boutique pricing at the lowest end of the market. Barnes Dennig is competitive within the regional-CPA tier, but a single-framework SOC 2 engagement at a tech-only specialist may price lower.

• Big Four brand requirement: if a board, investor, or enterprise customer specifically mandates a Big Four audit firm, Barnes Dennig is a regional CPA firm rather than a Big Four.