Is Thoropass an auditor?
Yes. Laika Compliance, LLC, doing business as Thoropass Assurance, is the licensed, AICPA peer-reviewed CPA firm that performs SOC audits and issues SOC reports. Thoropass, Inc., a separate company under the same brand, supplies the technology the audit runs on.
This page evaluates Thoropass as an audit and assurance provider. If you are comparing the software subscription instead, use our separate Thoropass platform review and Thoropass software pricing analysis.
Quick verdict
Thoropass is strongest for established startups, scaleups, SMBs, and mid-market organizations that want an auditor-led engagement with technology Thoropass says is built to accelerate the audit. The firm identifies 51–350 employees as its sweet spot and says it can serve organizations up to roughly 1,000 employees.
Larger organizations and non-standard scopes are custom-quoted.
Its clearest advantage is that you do not have to change platforms. The audit team can work from evidence you keep in Vanta, Drata, Secureframe, Hyperproof, Archer, or OneTrust, and it owns the engagement from scoping to the signed report.
Thoropass and its affiliated entities can also sign a SOC 2 report, issue ISO 27001 certificates, assess PCI DSS as a QSA, and assess HITRUST, so a later framework does not mean a new audit firm.
What makes the Thoropass audit different?
Thoropass relaunched its website in October 2026 and calls itself an “AI-native” cybersecurity audit firm. Four points matter to a buyer:
- The audit comes first, and your GRC tool can stay. Thoropass says it runs audit program management and automates evidence collection. You can keep Vanta, Drata, or another GRC tool for the rest of your compliance program, and bring in a support partner if you need hands-on help with controls. The assurance team also supports readiness inside a first engagement, so you do not finish readiness with one provider and then explain the environment again to a newly introduced audit firm.
- The Audit Lifecycle Platform has a client side and an auditor side. For your team, Thoropass lists task tracking, controls mapping, and evidence collection through integrations and document sync. Smart Sort maps evidence from another GRC export or a spreadsheet to the right audit request, and an MCP server lets your own AI tools gather and submit evidence. Thoropass says the MCP server does not mean every GRC tool has a direct, automatic integration. On the auditor side, it describes AI used for scoping, testing, QA, and reporting, and First Pass checks evidence for completeness, consistency, and timeliness before an auditor sees it. These tools support the auditor’s judgment and do not replace it. Controls mapping also lets one evidence set serve SOC 2 alongside ISO 27001, HIPAA, HITRUST, or PCI DSS.
- Thoropass describes an audit team with big-firm backgrounds. It reports assessors with backgrounds at Deloitte, PwC, EY, KPMG, Coalfire, and Schellman, with an average of more than seven years of experience, an average response time under 24 hours, and a 100% acceptance rate for its reports among leading global enterprises. It also says 50 or more Fortune 500 companies have requested and accepted its reports. For the workflow, it reports that First Pass can cut secondary evidence requests by up to 80% and that audits can finish up to 62% faster than a traditional process.
- One customer example shows the multi-entity case. Thoropass reports that The Access Group, a UK-based multinational software company with about 8,000 employees, moved from Grant Thornton and EY to Thoropass and now has 13+ audits across 9 business units covering SOC 2, ISO 27001, and PCI DSS. Thoropass reports 50% less audit time and 25% lower costs.
Treat every figure above as Thoropass’s own, not a guarantee; readiness and scope still determine the calendar.
Who is Thoropass best for?
Thoropass is not limited to startups. Its assurance practice can also handle larger and more complex engagements.
| Company profile | Where Thoropass fits |
|---|
| Established startup or SMB under 100 employees | A Type 1-to-Type 2 roadmap with the option to add ISO 27001, HIPAA, PCI DSS, or another supported framework under the same audit partner. |
| Scaleup or mid-market company, especially 51–350 employees | Thoropass’s stated sweet spot: a dedicated assurance relationship and compatibility with your existing GRC platform. |
| Larger organization, roughly 351–1,000 employees | Expect a scoped, custom quote, especially at 501+ employees or with a more complex program. |
SaaS, technology, and AI companies
Thoropass fits cloud and product teams that need SOC 2 to support enterprise sales, then expect the compliance program to widen. The same audit workflow can accommodate a first Type 1, the following Type 2, and adjacent ISO 27001 work without forcing a GRC migration. AI companies can also use Thoropass for SOC 2 and ISO 27001, the HITRUST AI Security Assessment, AI-enabled penetration testing, and AIUC-1 readiness. Thoropass holds ISO 42001 certification itself and markets ISO 42001 certification audits through its subsidiary Thoropass Certification LLC. Thoropass has not announced an accreditation body for ISO 42001, so confirm the accreditation body named on any ISO 42001 certificate. See more SOC 2 auditors for AI companies and SOC 2 auditors for SaaS.
Fintech, payments, and insurtech
Fintech buyers benefit when SOC 2 is only one part of the request. Thoropass’s PCI assessor capabilities and support for 23 NYCRR 500 make it relevant to payments, lending, insurance, and infrastructure companies that need one assurance team to understand overlapping controls. Named customers include Moov and Forage. Compare the broader SOC 2 auditor market for fintech.
Healthcare and healthtech
Thoropass is a HITRUST Authorized External Assessor and conducts HIPAA/HITECH assessments, so healthcare SaaS and PHI-sensitive organizations can coordinate HITRUST, HIPAA, and SOC 2 around shared evidence. Published customer examples include Array Behavioral Care, Alaffia Health, HealthSnap, and AcuityMD. For alternatives, see SOC 2 auditors for healthcare.
How much does a Thoropass SOC 2 audit cost?
Beyond any published package, Thoropass quotes each engagement individually and says the price typically reflects both the platform and the audit. Scope drives the number: how many systems, entities, and locations are covered, which Trust Services Criteria are in scope, how many frameworks you add, and how long the audit period runs.
What larger organizations should expect
Expect a custom quote when the audit covers more systems, Trust Services Criteria, divisions, readiness work, or additional frameworks. Organizations with 501+ employees are always custom-priced.
Thoropass’s ballparks for larger, scoped engagements show how quickly complexity can move the price. Use them to set expectations, not as a rate card or a promise that your engagement will land in the same range.
| Organization and scope | Thoropass ballpark |
|---|
| 201–500 employees; SOC 2 Type 2; 1–3 systems; controls being built | $25,000–$35,000 |
| 201–500 employees; SOC 2 Type 2; 10+ systems; controls built | $30,000–$45,000 |
| 201–500 employees; SOC 2 Type 2 + ISO 27001; 4–10 systems; controls not yet built | $40,000–$60,000 |
| 500+ employees; SOC 2 Type 2 renewal; all five Trust Services Criteria; 10+ systems | $60,000–$85,000 |
For a 201–500 employee Type 2 engagement, Thoropass’s ballparks ran from $25,000 to $45,000. Adding ISO 27001 and substantial readiness work moved one scope to $40,000–$60,000, while a complex 500+ employee renewal reached $60,000–$85,000. If your environment looks more like these examples, compare the exact scope and delivery model instead of assuming the price will scale with headcount alone.
What audits and frameworks does Thoropass cover?
Thoropass Assurance directly performs SOC 1, SOC 2 Type 1 and Type 2, and SOC 3 engagements. Its broader accredited and assessment capabilities include:
- HITRUST: e1, i1, and r2 assessments, plus the HITRUST AI Security Assessment, through its Authorized External Assessor status
- PCI DSS: Report on Compliance, Attestation of Compliance, and related work through its QSAC and ASV capabilities
- HIPAA: Security Rule, Breach Notification Rule, and Privacy Rule assessments for organizations handling protected health information
- ISO 27001: certification through Thoropass Certification LLC, a subsidiary of Thoropass, Inc., which announced accreditation for ISO/IEC 27001:2022 certification audits in September 2026. Its stated scope includes the ISO 27017 and ISO 27018 cloud security and privacy controls
- ISO 42001: marketed as certification audits through Thoropass Certification LLC (see the accreditation note above)
- GDPR: assessments of how you handle personal data under the regulation
- Penetration testing: CREST lists Thoropass as accredited for penetration testing and AI-enabled penetration testing
- Additional readiness and control mapping: AIUC-1, NIST CSF 2.0, NIST 800-53, CMMC Level 1, CCPA, and 23 NYCRR 500
Thoropass is not presented here as a FedRAMP 3PAO, StateRAMP assessor, or CMMC Level 2 C3PAO. Buyers targeting those authorizations will need the appropriate specialist partner.
How does Thoropass address auditor independence?
The audit entity is Laika Compliance, LLC dba Thoropass Assurance, legally separate from Thoropass, Inc. and bound by the AICPA Code of Professional Conduct. The public peer-review file records a pass accepted 12 December 2025, covering the period through 31 January 2025.
That peer-review result is the public quality record for the CPA practice. It does not remove every buyer-side policy question. Some enterprise procurement teams require an audit firm with no common ownership with a software provider, a stricter rule than the AICPA baseline. If your audit committee has that policy, settle it before signing.
How long does a Thoropass SOC 2 audit take?
The 2–6 week figure in this directory refers to a likely fieldwork-to-report window when the scope is settled and evidence is ready. It is not a promise that a company starting without policies, controls, or an observation period will receive a report in six weeks.
Thoropass’s own SOC 2 cost guide gives broader end-to-end planning ranges of 2–3 months for Type 1 and 3–9 months for Type 2 for companies with 5–100 employees. Thoropass’s published customer outcomes show the fast end for prepared teams: Benefix completed Type 1 and Type 2 work within eight days after kickoff, while Cinchy reports receiving ISO 27001 in four weeks and SOC 2 in two weeks. These are customer-reported outcomes, not planning defaults.
When is Thoropass not the right fit?
Thoropass is a poor fit when you need a Big Four name, FedRAMP, StateRAMP, or CMMC Level 2 from the same provider, or a policy that forbids common ownership between the GRC platform and the audit firm. Choose another route when:
- your board, customer, or capital-markets plan requires a Big Four name on the report;
- you need FedRAMP, StateRAMP, or CMMC Level 2 work from the same provider;
- your procurement policy prohibits common ownership between the GRC platform and audit firm;
- you need a fixed published price for a complex scope or a 501+ employee environment before the firm has scoped it; or
- you want a software-only purchase and have not yet decided who should perform the audit.
What do clients say about Thoropass?
“We saved roughly 1,000 person-hours in walkthroughs alone.”
— GoTo, quoted on the Thoropass homepage
“Some of the best money I ever spent. Thoropass and being compliant ended up helping us close our second-largest customer.”
— Veronica Lim, CFO, Benefix
“For the past month, we’ve told our customers we’re in the process of getting our SOC 2 and ISO 27001. Having the reports in our hands alleviates any concern from our customers.”
— Saskia, Cinchy
“With no prior knowledge, Thoropass laid out an easy-to-understand road map. Setting attainable goals with reasonable timetable made the process extremely easy with multiple team members.”
— Adam S., VP of Operations
What is our verdict on Thoropass Assurance?
Thoropass’s main draw is removing the handoff between compliance work and the audit. Thoropass presents itself as an audit firm first, with an audit platform built to move evidence from collection to auditor review. Its assurance team can take evidence from the GRC platform you already have, and Thoropass says its technology reduces sorting and rework and lets it coordinate several frameworks without treating each one as a new project.
For established startups and SMBs, the draw is covering the next two or three compliance steps with one audit partner. For scaleups and mid-market teams, the 51–350 employee sweet spot, multi-framework capabilities, and compatibility with existing GRC platforms are the stronger reasons to shortlist it. For larger organizations, Thoropass has quoted custom-scoped work, as the ballpark ranges above show, so it is not limited to the startup market.
Thoropass is a strong candidate for SaaS, technology, AI, fintech, and healthcare buyers who value an auditor-led relationship and the evidence workflow Thoropass describes. Before deciding, compare the exact scope, observation period, report deliverables, and the named audit team.
Menu
