Menu
Many founders believe compliance platforms like Vanta or Drata produce a SOC 2 report; they automate evidence collection and readiness tracking, but you still need a separate, independent CPA firm to conduct the actual examination and sign the report.
What you can do without an auditor
Plenty. You can implement every control in the AICPA Trust Services Criteria, write all required policies, collect evidence, run quarterly access reviews, set up vendor risk processes, and execute a self-led readiness assessment. None of that work requires an auditor. In fact, doing it well before the auditor engages is the single biggest lever on audit cost and timeline.
What only an auditor can do
Issue the report. The independence requirement under SSAE 18 (the AICPA attestation standard SOC 2 reports are issued under) means the firm signing the opinion cannot have helped you implement the controls they are auditing. That is why “outsourced compliance program” services usually run through one entity and the audit through a separate, independent firm.
The cost lever
The way audit fees scale is roughly: more time on the auditor’s side equals more cost. Teams that show up with mature documentation, tested controls, mapped evidence, and a populated GRC platform typically spend 30 to 50 percent less than teams that hand a raw company over to the auditor. The savings come from fewer billable hours of clarification, fewer rework cycles, and a shorter fieldwork window.
What “SOC 2-style” reports are not
Some platforms market self-generated security overviews as SOC 2-equivalent. They are not. A serious procurement reviewer will ask for the auditor’s opinion letter, the system description, and the test results. None of that exists in a self-produced document. Skip the workaround and budget for the real audit when the time comes.