How Does AICPA Peer Review Affect SOC 2 Audit Firm Quality?

An AICPA peer review is an outside review of how a CPA firm runs its audit and attestation practice, and most of the result can be looked up for free. A Pass is the normal result. A Pass with deficiencies can only be judged once you know what the deficiency was, and a Fail is a finding that the firm’s quality system has significant deficiencies. A missing result on the public file is a gap in what you can see, and it is not a bad rating. This page covers which review a SOC 2 firm receives, what the three ratings mean, what the results look like across the firms in our directory, and how to check one firm yourself. Our shortlist of the best SOC 2 auditors shows the peer review evidence we hold for each firm and leaves missing results visible.

Which kind of peer review does a SOC 2 firm get?

A firm that issues SOC 2 reports gets a System Review. Every firm enrolled in the AICPA Peer Review Program is reviewed once every three years, and the program has two review types. An Engagement Review is available to firms that “do not perform audits or other similar work and perform work only under the SSARSs and the SSAEs, other than examinations as their highest levels of service” (AICPA peer review summary, checked on 2026-10-20). A SOC 2 report is an examination under the SSAEs, so a firm that issues them falls outside that description. If a firm’s latest review is an Engagement Review, ask which engagements it performs.

In a System Review the reviewer studies the firm’s own system of quality management, interviews staff, and tests a sample of engagements taken from across the practice, with emphasis on higher-risk work. Examinations of service organizations (SOC 1 and SOC 2) are “must-select” engagements, so the reviewer has to include them in the sample when the firm performs them.

What do Pass, Pass with deficiencies and Fail mean?

In a System Review the rating is a conclusion about the firm’s system, using the AICPA’s wording from the same summary:

You will see other definitions in circulation: pass with deficiencies as “at least one but not all engagements nonconforming” and Fail as “all engagements nonconforming”. Those are the AICPA’s definitions for Engagement Reviews. A System Review rating rests on the system, and a Fail rests on significant deficiencies in it.

The wording changed with the AICPA’s quality management standards. Until SQMS took effect on 15 December 2025, firms followed the older quality control standards, and the quality management changes to the peer review standards apply to reviews with years ending on or after 31 December 2025 (AICPA peer review standards page, checked on 2026-10-20). The three ratings stay the same. Reports for earlier years say “system of quality control” and later ones say “system of quality management”, so check the review year before you compare two firms.

What do the results look like across the firms we list?

This table counts the SOC 2 issuers in our directory that fall under US peer review, by what the public file shows for each:

Shares are of the firms in the table and are rounded. Firms outside US peer-review scope are not counted. A status no firm in the directory holds is left out. Each firm's own status and check date are on its profile. Source: the AICPA public file search.

At our last check, most firms we list showed a public Pass. The rows without a rating mostly describe what is visible, and are not findings about quality. The public file shows review documents for firms that belong to the AICPA’s Private Companies Practice Section, Employee Benefit Plan Audit Quality Center or Governmental Audit Quality Center, or that asked for their documents to be public. For other firms it shows enrollment status without the documents (AICPA Peer Review public site). So “Review accepted, rating not public” means the firm completed a review and you need to ask it for the report. “Enrolled, no completed review shown” calls for a direct question about when its latest review closed. If a firm you are considering shows “Not enrolled” or a rating below Pass, ask for its most recent report and any corrective action before you go further.

Each firm’s own status and check date are on its profile in the directory. The SOC 2 audit firm statistics place the same peer review record in the wider market.

Does a Pass mean your SOC 2 report will be good?

A Pass is a conclusion about the firm’s system based on a sample, and it says nothing certain about your report. The AICPA states that a peer review gives reasonable, not absolute, assurance, rests on selective tests, and “does not provide assurance with respect to any individual engagement conducted by the firm.” Ask the firm whether SOC 2 examinations were in its review sample, and look at the review year: a rating for a year that ended long ago says little about the team that will staff your audit.

SOC 2 work has been getting closer attention from reviewers. In May 2026 the AICPA told peer reviewers that examining a single SOC 2 engagement file is often insufficient to address the risks it describes (Journal of Accountancy, May 2026). It asks them to look at the firm’s use of external SOC platforms, whether engagement timelines are reasonable, and whether each engagement is tailored to the client. Engagements with identical risk assessments, sample sizes or testing procedures can be judged nonconforming, which makes a deficiency or significant deficiency more likely. A review that closed before that alert was not done with it in hand.

How do you read a Pass with deficiencies or a Fail?

Read the documents themselves. The public file can hold the review report, the firm’s letter of response, the acceptance letter, and a letter confirming that required follow-up actions are complete. Four questions to ask of them:

1. What does the report say the deficiency is? When a deficiency is tied to a must-select engagement such as a SOC 2 examination, the report names that engagement type or the industry.
2. Does the letter of response say what the firm changed?
3. Was follow-up required, and is it marked complete? Follow-up can include revisions to the firm’s system or an outside review of completed engagements.
4. Does the same deficiency appear in the firm’s previous review?

In our reading, a deficiency in how the firm performs SOC engagements, or one repeated from the prior review, bears directly on your report. A deficiency confined to another engagement type or to paperwork bears on it less. The AICPA publishes a list of common peer review deficiencies in SOC 1 and SOC 2 engagements that helps you see what a given finding usually covers.

A Fail is a finding of significant deficiencies, and it does not by itself end a firm’s licence. State boards of accountancy handle pass with deficiencies and fail reports differently, according to NASBA’s April 2025 best-practice guidance. Treat a Fail as a reason to ask for the corrective action and the current standing in writing.

How do you check a firm’s peer review yourself?

1. Find the legal name of the CPA firm that signs the SOC 2 report. It is on the auditor’s report and in the engagement letter, and it can differ from the brand name on the proposal. Peer review attaches to the legal entity, so for an enterprise shortlist confirm the entity you will contract with.
2. Search that name, then any trade name, in the AICPA Peer Review Public File. Note whether the firm is enrolled and which programs it belongs to.
3. If documents are listed, open the review report for the rating, then the letter of response and the acceptance letter. Write down the review year-end. Reviews come around every three years, so an old date needs an explanation.
4. If no documents are listed, you have an unknown result. It is not a Fail, and it is not a Pass either: reviews rated Pass with Deficiencies or Fail are accepted too, so an acceptance date tells you only that the review was completed and accepted. Ask the firm in writing for its most recent peer review report, any letter of response, and the acceptance letter, and ask which review type it received. If the firm tells you it passed, ask for the report itself, since “passed” is sometimes used for a Pass with Deficiencies. A firm can share these voluntarily. If it declines, you are left with an unknown rating and can weigh that. The AICPA Peer Review Program answers status questions at 919.402.4502 or prsupport@aicpa.org.
5. Confirm the firm’s state CPA licence with its state board. Licensing and AICPA membership are separate from peer review, and the SOC 2 auditor certification guide explains how the three differ and where to look each one up.

Peer review is one input into picking a firm. Pricing, timeline, and fit with your industry come from the guide to choosing a SOC 2 auditor.