Big Four SOC 2 Auditors: Deloitte, PwC, EY and KPMG Compared

Which Big Four firm should perform your SOC 2 audit?

First rule out any Big Four firm that designed, implemented, or runs controls in your SOC 2 scope, because it cannot independently test its own work. Then choose among the rest on the named engagement team, the add-on reports you need, and the member firm that will sign in your country. Price rarely separates them: our directory's median planning band for a Big Four Type 2 is $65,000–$200,000, and scope moves a quote more than the logo does. These are planning figures, not quotes.

The four networks in our directory: US peer review, report types the US firm lists, and countries covered

Network	US peer review	Reports the US firm lists	Countries in our directory
Deloitte	Pass (review Dec 2023)	SOC 1, SOC 2, SOC 3, HITRUST, FedRAMP	USA, Australia, Canada, Germany, India
PwC	Pass (review Dec 2024)	SOC 1, SOC 2, SOC 2+, ISAE 3000, SWIFT CSP	USA, Australia, Canada, Germany
EY	Pass (review Dec 2025)	SOC 1, SOC 2, SOC 3, SOC for Cybersecurity, HITRUST, SOC for Supply Chain, SWIFT, C5	USA, Australia, Canada, Germany, India
KPMG	Pass (review Dec 2023)	SOC 1, SOC 2, SOC 2+, SOC 3	USA, Australia, Canada, Germany, India

Peer-review results come from the AICPA public file, checked October 2026. "Rating not public" means the file shows enrollment without a published rating; it is not a failed review. The price band is the median across 19 regional Big Four records.

This guide is for teams that already need a Big Four report, usually because a customer, board, lender, or acquirer named one, and now have to pick between Deloitte, PwC, EY, and KPMG. If you are still deciding whether you need the Big Four at all, start with our Big Four versus specialist comparison.

Rule out the firms you already work with

A SOC 2 report is an attestation, so the AICPA independence rules apply to the firm that signs it. The AICPA Code of Professional Conduct treats accepting responsibility for “designing, implementing, or maintaining internal controls” for an attest client as a management responsibility that impairs independence (AICPA Code, 1.295.030). A network that implemented your identity, logging, or GRC tooling, or that runs outsourced internal audit over controls in scope, is the one most likely to be out.

Auditing your financial statements does not, on its own, disqualify a firm. If you are an SEC registrant, your audit committee must pre-approve every audit and non-audit service your financial-statement auditor provides (Regulation S-X, Rule 2-01(c)(7)), so build that approval into the timeline.

The firms run these checks themselves. KPMG’s US SOC 2 page notes that some of the services it describes “may not be permissible for KPMG audit clients” (KPMG). Ask each firm for its conflict-check result before you spend time on scoping calls. If one network audits your accounts and another advised on the systems in scope, you may have two candidates left before price comes up.

What each firm offers beyond a standard SOC 2

All four issue SOC 1 and SOC 2 reports. They differ in the add-on reports and programs their US practices advertise, which matters when one customer wants SOC 2 and another wants FedRAMP, HITRUST, or a German cloud attestation.

Deloitte. Its US third-party assurance practice lists FedRAMP and HITRUST attestation alongside SOC reporting (Deloitte). If you sell to US federal agencies as well as commercial buyers, ask Deloitte whether one team can coordinate the FedRAMP assessment and the SOC 2. Its US attestation reports are issued by Deloitte & Touche LLP.

PwC. PwC’s Digital Assurance and Transparency practice offers SOC 2+, which adds criteria such as HITRUST, GDPR, or NIST to the SOC 2 examination. It has also performed SWIFT Customer Security Programme attestations under ISAE 3000 for more than ten years, and it runs a program called SECO to coordinate several SOC reports and certifications on one schedule (PwC). It fits a company that already owes customers several reports a year.

EY. EY’s US Technology Risk practice lists SOC 1, SOC 2, SOC 3, SOC for Cybersecurity, and SOC for Supply Chain, plus attestations against other criteria including SWIFT, HITRUST, and C5, the German federal cloud security catalogue. ISO certification comes from EY CertifyPoint, which EY describes as its accredited certification body (EY). Of the four US pages, only EY’s names C5 or its own ISO certification body, so call EY first if you need SOC 2 and ISO 27001 from one network or if German cloud customers ask for C5.

KPMG. KPMG’s main US SOC 2 page describes the examination itself. Its US digital asset assurance practice offers SOC 2+, which adds criteria such as the HITRUST CSF, NIST, FedRAMP, or the CryptoCurrency Security Standard to a single report (KPMG). That page is written for digital asset firms, so ask whether the same mappings are available for your industry.

These lists describe what each firm advertises. They do not rank quality, and a mapping missing from a firm’s web page is worth asking about.

Confirm which member firm signs the report

Each Big Four name covers a network of separate legal entities. Deloitte’s own notice says “DTTL and each of its member firms are legally separate and independent entities.” PwC describes its member firms as separate legal entities, and KPMG LLP is a Delaware limited liability partnership within a global organization of independent member firms. One member firm signs your report, and its licence and peer review are the ones that count.

For a company whose systems run from one country, that is simple. For a multinational, ask whether the US member firm will sign with the German or Australian firm assisting, or whether the local firm will issue its own report. Member firms outside the US often report under international or local standards, such as ISAE 3000 and ISAE 3402 in Germany or ASAE 3000 and ASAE 3150 in Australia. Before you choose, check which report your customers’ vendor-risk teams will accept: a team that asks for “a SOC 2” may mean the AICPA report specifically.

Why price will not choose the firm for you

Our directory’s prices for the four networks are planning estimates, not quotes. A Big Four quote moves on scope:

• the number of legal entities and countries in the system description
• criteria beyond Security, and any SOC 2+ mappings
• subservice organizations you include rather than carve out
• a first examination versus a renewal with the same team

Compare proposals only after each firm has priced the same scope. For the line items behind a SOC 2 fee, see the SOC 2 audit cost overview.

Questions to ask every Big Four proposal

1. Who are the engagement partner and manager, how many SOC 2 examinations has each led, and will they stay on the engagement next year?
2. Has anyone on the proposed team done readiness or advisory work for us? If so, how is that work kept separate from the examination?
3. Which member firm signs, under which attestation standard, and does one report cover every entity in scope?
4. Is the fee split into examination, readiness, technology charges, and any SOC 2+ mapping? What triggers a change order: added criteria, late evidence, or extra entities?
5. Are the fieldwork dates, review window, and report date written into the engagement letter?
6. If the team automates evidence collection, which tool does it use, who reviews the output, and does automation change the fee or the timeline?

Ask for the answers to the first three in writing. They show whether the firm has finished its conflict check and staffed the work.

When none of the four is the right call

If no customer, regulator, or deal document names the Big Four, a specialist firm can issue the same AICPA report. In our view, for many single-region software companies a specialist fits the scope better and is worth a quote alongside the Big Four. Our enterprise SOC 2 auditor comparison covers both Big Four and non-Big Four firms that handle multi-entity programs, and the best SOC 2 auditors list compares specialists on price, timeline, and peer review.