Frank, Rimerman + Co.

About Frank, Rimerman’s SOC 2 Practice

Frank, Rimerman + Co. LLP is a Palo Alto-based CPA firm, founded in 1949, with roughly 500-700 people across seven California and Utah offices; its SOC and ISO examination work sits inside a dedicated Risk Advisory & Assurance practice, not as a side offering of the tax and accounting business. The firm has been embedded in Silicon Valley’s venture and technology community since the earliest days of the venture capital industry, and that client base — SaaS, software, fintech, life sciences, and venture-backed companies — is exactly who the Risk Advisory & Assurance group is built to serve.

Frank, Rimerman is also an independent member of Baker Tilly International, one of the ten largest global accountancy networks, giving it reach into 140+ territories for clients with cross-border audit or advisory needs, even though the SOC/ISO practice itself is delivered out of the US offices.

Audit Quality and Credentials

Frank, Rimerman + Co. LLP is a licensed CPA firm and AICPA member, which is the baseline requirement for issuing a SOC report — a SOC 1, SOC 2, or SOC 3 attestation is only as credible as the CPA firm behind it. The firm is enrolled in the AICPA Peer Review Program, and its most recent peer review, dated March 18, 2026, resulted in a pass rating for the engagement period June 1, 2024 through May 31, 2025. Buyers can verify this directly on the AICPA Peer Review public file search. A pass this recent is a meaningful signal — it means the firm’s SOC methodology was independently reviewed and cleared well within the current audit cycle.

SOC 1, SOC 2, and SOC 3 Examinations

Frank, Rimerman’s Risk Advisory & Assurance group performs the full SOC family: SOC 1 (internal controls over financial reporting, typically used for SOX purposes), SOC 2 (Type I and Type II, covering security, availability, confidentiality, processing integrity, and privacy), SOC 3 (the public-facing condensed summary of a SOC 2), and SOC 2+, which layers additional criteria — most commonly ISO 27001 or HIPAA — onto a standard SOC 2 examination so a client only runs one evidence-collection cycle instead of two separate audits. The practice is led by Assurance and Advisory Partners Nelly Spieler and Jason Stork, and the firm advertises unlimited partner and manager access throughout the engagement rather than gating communication to a junior staff auditor.

The ISO 27001/27701 Certification Body — Issuing Both SOC and ISO

Frank, Rimerman’s real differentiator in the SOC 2 market is that it can carry a client from a SOC 2 report through to an ISO 27001 (and ISO 27701 privacy) certification under the same firm brand — a combination most SOC 2-only shops cannot offer in-house. Get the structure right, because it matters for independence: the SOC attestation is issued by Frank, Rimerman + Co. LLP (the CPA firm), while the ISO and CSA STAR certifications are issued by Frank, Rimerman Information Security LLC, a separate legal entity that is affiliated with, but organizationally distinct from, the CPA firm. That separation is not incidental — ANAB accreditation for a certification body requires exactly this kind of structural independence from a firm’s advisory work, the same principle that keeps a CPA firm’s attest opinions clean of self-review risk.

Frank, Rimerman Information Security LLC is accredited by the ANSI-ASQ National Accreditation Board (ANAB) to certify against ISO/IEC 27001 (information security management) and ISO/IEC 27701 (the privacy extension to 27001, useful for GDPR-adjacent obligations). The firm’s marketing also references ISO 27017 (cloud security) and 27018 (PII in the cloud) as part of the “ISO family” it can assess against, but its stated ANAB accreditation covers 27001 and 27701 specifically — buyers who need a standalone 27017 or 27018 certificate should confirm current accreditation scope directly with the firm before assuming coverage. Being one of the small number of public accounting firms accredited as an ISO 27001 certification body is a genuinely uncommon capability; most SOC 2 audit firms partner out ISO work rather than issue it themselves.

CSA STAR Level 2 Certification

Frank, Rimerman Information Security LLC also holds Cloud Security Alliance (CSA) accreditation to issue CSA STAR Level 2 Certification, which combines the ISO/IEC 27001 standard with the CSA’s Cloud Controls Matrix for a cloud-specific maturity assessment, and lists the firm on the CSA STAR Certified Auditors Registry. This is pitched as a natural next step for cloud-native companies that already hold or are pursuing ISO 27001 and want a deeper, cloud-specific layer of assurance without a full separate audit cycle.

Industries Served

The Risk Advisory & Assurance practice’s client base mirrors the firm’s broader technology and life sciences focus: SaaS and software companies, fintech, healthcare and health-tech, life sciences (pharma, biotech, medical device, digital health), and venture-backed companies generally. The firm’s decades of work with Silicon Valley venture capital and growth-stage technology clients shape how its SOC and ISO teams scope and staff engagements — they are used to the pace and audit-readiness gaps typical of a company preparing for its first enterprise deal or funding round with a compliance requirement attached.

Frameworks Frank Rimerman Does Not Cover

Frank, Rimerman’s public service pages do not describe HITRUST, FedRAMP, StateRAMP, CMMC, or PCI DSS QSA work as part of the Risk Advisory & Assurance offering. Buyers whose roadmap includes any of those frameworks should plan on a separate specialist firm for that scope, at least until Frank, Rimerman publishes evidence of accreditation in those areas.

Pricing

Frank, Rimerman does not publish SOC 2 pricing. Based on the firm’s mid-tier CPA positioning and Bay Area cost base, our estimated range is $20,000-$60,000 for a Type I and $30,000-$80,000 for a Type II — directional figures, not a quote from the firm, and actual pricing will move with scope, framework count (a combined SOC 2+ISO engagement costs more than either alone), headcount, and cloud footprint. Request a quote for a firm-specific number.

Timeline

Fieldwork-to-report for a SOC examination at Frank, Rimerman runs an estimated 4-12 weeks, though that window covers only the audit itself. A SOC 2 Type II additionally requires an observation period — typically 3 to 12 months of continuous control operation — before fieldwork can even begin, a constraint of the SOC 2 standard itself rather than anything specific to this firm. Combining SOC 2 with an ISO 27001 or CSA STAR certification in one coordinated engagement is the practice’s stated goal of reducing duplicate evidence requests, but it does not shorten either framework’s underlying observation-period requirements.

Who Should Choose Frank Rimerman

Best fit for:

• SaaS, fintech, healthcare/health-tech, and life sciences companies in Frank, Rimerman’s home Silicon Valley/Bay Area market that want a recognized, 75-year-old CPA firm name on the report
• Companies that will need both a SOC 2 report and an ISO 27001 (or 27701) certification and want that continuity handled by one affiliated firm rather than two unrelated vendors
• Cloud-native companies already holding or pursuing ISO 27001 that want to add CSA STAR Level 2 without starting a new audit relationship
• Venture-backed startups whose deal or funding timeline benefits from a firm fluent in the Silicon Valley investor and enterprise-buyer context
• Buyers who value direct, unlimited partner-and-manager access over being routed to junior staff

Not a fit — look elsewhere if:

• You need HITRUST, FedRAMP, StateRAMP, CMMC, or PCI DSS QSA work; none of these appear in Frank, Rimerman’s published scope
• You want the very lowest-cost boutique SOC 2 shop; a mid-tier regional CPA firm’s overhead puts it above the cheapest specialist auditors
• Your business has no California/Bay Area or broader life sciences/technology footprint and gets no benefit from the firm’s regional network

Bottom Line

Frank, Rimerman’s SOC 2 practice trades on two things a lot of SOC 2 shops can’t match: a genuinely recent AICPA peer review pass (March 2026, covering mid-2024 through mid-2025) and an in-house path from SOC attestation to ISO 27001/27701 and CSA STAR Level 2 certification, delivered through an affiliated but organizationally separate entity (Frank, Rimerman Information Security LLC) as accreditation independence rules require. For a Bay Area SaaS, fintech, or life sciences company that expects to need both a SOC 2 report and an ISO certification eventually, that continuity is worth the mid-tier pricing. For HITRUST, government frameworks, or the absolute lowest-cost SOC 2, look to a specialist firm instead.