Frank, Rimerman + Co.

Who is Frank Rimerman?

Frank, Rimerman + Co. LLP is a Palo Alto-based CPA firm, founded in 1949, with roughly 500-700 people across seven California and Utah offices; its SOC and ISO examination work sits inside a dedicated Risk Advisory & Assurance practice, not as a side offering of the tax and accounting business.

The firm says it has worked in the Silicon Valley tech and VC ecosystem for 75+ years, and that client base (SaaS, software, fintech, life sciences, and venture-backed companies) is who the Risk Advisory & Assurance group is built to serve.

Frank, Rimerman is also an independent member of Baker Tilly International, one of the ten largest global accountancy networks, giving it reach into 140+ territories for clients with cross-border audit or advisory needs, even though the SOC/ISO practice itself is delivered out of the US offices.

What credentials does Frank Rimerman actually hold?

Frank, Rimerman + Co. LLP is a licensed CPA firm and AICPA member; a licensed CPA firm is the baseline requirement for issuing a SOC report.

The firm is enrolled in the AICPA Peer Review Program, and its most recent peer review, dated March 18, 2026, resulted in a pass rating for the engagement period June 1, 2024 through May 31, 2025. Buyers can verify this directly on the AICPA Peer Review public file search.

What SOC reports does Frank Rimerman issue?

Frank, Rimerman’s Risk Advisory & Assurance group performs the full SOC family: SOC 1 (internal controls over financial reporting, typically used for SOX purposes), SOC 2 (Type 1 and Type 2, covering security, availability, confidentiality, processing integrity, and privacy), SOC 3 (the public-facing condensed summary of a SOC 2), and SOC 2+, which layers additional criteria (most commonly ISO 27001 or HIPAA) onto a standard SOC 2 examination so a client only runs one evidence-collection cycle instead of two separate audits. The practice is led by Assurance and Advisory Partners Nelly Spieler and Jason Stork, and the firm advertises unlimited partner and manager access throughout the engagement.

Is Frank Rimerman an ISO 27001 certification body?

Frank, Rimerman’s main differentiator in the SOC 2 market is that it can carry a client from a SOC 2 report through to an ISO 27001 (and ISO 27701 privacy) certification under the same firm brand, with the certification issued by an affiliated certification body.

The structure matters for independence: the SOC attestation is issued by Frank, Rimerman + Co. LLP (the CPA firm), while the ISO and CSA STAR certifications are issued by Frank, Rimerman Information Security LLC, a separate legal entity that is affiliated with, but organizationally distinct from, the CPA firm.

Frank, Rimerman Information Security LLC is accredited by the ANSI-ASQ National Accreditation Board (ANAB) to certify against ISO/IEC 27001 (information security management) and ISO/IEC 27701 (the privacy extension to 27001, useful for GDPR-adjacent obligations). The firm’s marketing also references ISO 27017 (cloud security) and 27018 (PII in the cloud) as part of the “ISO family” it can assess against, but its stated ANAB accreditation covers 27001 and 27701 specifically, so buyers who need a standalone 27017 or 27018 certificate should confirm current accreditation scope directly with the firm before assuming coverage.

Does Frank Rimerman cover CSA STAR?

Frank, Rimerman Information Security LLC also holds Cloud Security Alliance (CSA) accreditation to issue CSA STAR Level 2 Certification, which combines the ISO/IEC 27001 standard with the CSA’s Cloud Controls Matrix for a cloud-specific maturity assessment, and lists the firm on the CSA STAR Certified Auditors Registry.

This is pitched as a natural next step for cloud-native companies that already hold or are pursuing ISO 27001 and want a deeper, cloud-specific layer of assurance without a full separate audit cycle.

Which industries does Frank Rimerman actually serve?

The Risk Advisory & Assurance practice’s client base mirrors the firm’s broader technology and life sciences focus: SaaS and software companies, fintech, healthcare and health-tech, life sciences (pharma, biotech, medical device, digital health), and venture-backed companies generally.

Which frameworks does Frank Rimerman cover?

Frank, Rimerman’s public service pages do not describe HITRUST, FedRAMP, StateRAMP, CMMC, or PCI DSS QSA work as part of the Risk Advisory & Assurance offering. Buyers who need any of those frameworks should plan on a separate specialist firm for that scope, at least until Frank, Rimerman publishes evidence of accreditation in those areas.

How much does a Frank Rimerman SOC 2 audit cost?

Frank, Rimerman does not publish SOC 2 pricing. Our estimates are $20,000–$60,000 Type 1 and $30,000–$80,000 Type 2; a combined SOC 2+ISO job costs more than either alone.

Request a quote for a firm-specific number.

How long does a Frank Rimerman SOC 2 audit take?

Fieldwork-to-report for a SOC examination at Frank, Rimerman runs an estimated 4-12 weeks, though that window covers only the audit itself.

A SOC 2 Type 2 additionally requires an observation period, typically 3 to 12 months of continuous control operation, before fieldwork can begin, a constraint of the SOC 2 standard itself rather than anything specific to this firm. Combining SOC 2 with an ISO 27001 or CSA STAR certification in one coordinated engagement is the practice’s stated goal of reducing duplicate evidence requests, but it does not shorten either framework’s underlying observation-period requirements.

Who is Frank Rimerman a good fit for?

Frank, Rimerman fits Bay Area SaaS, fintech, and life-sciences buyers that want a CPA name dating to 1949 plus an affiliated path to ISO 27001/27701 and CSA STAR Level 2.

Best fit for:

• SaaS, fintech, healthcare/health-tech, and life sciences companies in Frank, Rimerman’s home Silicon Valley/Bay Area market that want a recognized CPA firm name, dating to 1949, on the report
• Companies that will need both a SOC 2 report and an ISO 27001 (or 27701) certification and want that continuity handled by one affiliated firm rather than two unrelated vendors
• Cloud-native companies already holding or pursuing ISO 27001 that want to add CSA STAR Level 2 without starting a new audit relationship
• Buyers who value direct, unlimited partner-and-manager access over being routed to junior staff

Not a fit if:

• You need HITRUST, FedRAMP, StateRAMP, CMMC, or PCI DSS QSA work; none of these appear in Frank, Rimerman’s published scope
• You want the very lowest-cost boutique SOC 2 shop; our estimates start at $20,000 for a Type 1 and $30,000 for a Type 2
• Your business has no California/Bay Area or broader life sciences/technology footprint and gets no benefit from the firm’s regional network

When should a buyer shortlist Frank Rimerman?

Shortlist Frank, Rimerman for a March 2026 AICPA peer-review pass plus an affiliated path from SOC to ISO 27001/27701 and CSA STAR Level 2 via Frank, Rimerman Information Security LLC. That continuity is the mid-tier Bay Area pitch.

For a Bay Area SaaS, fintech, or life sciences company that expects both a SOC 2 report and an ISO certification, that continuity is the reason to pay mid-tier pricing.