Methodology: How We Review SOC 2 Auditors and Software

The editorial wall

Some of the platforms and firms on this site pay us. That pays for the research and keeps us independent of any single vendor. It also makes the firewall below the most important part of this page.

The point is not that sponsorship is bad. The point is that sponsorship must be visible, constrained, and unable to change the editorial answer a buyer gets.

Sponsorship buys: Featured positioning on the software hub, inclusion in scenarios a vendor actually fits, badges on review pages, and featured slots in a monthly digest.
Sponsorship does not buy: A higher rating, softer criticism, removal of a weakness, hidden placement, inclusion in a ranking where the firm does not qualify, suppression of buyer corrections, or routing priority over a better-fit firm.

Firewall rule

If you find a sponsored review that breaks these rules, email us. We fix the review or end the sponsorship. Those are the only two outcomes.

What we cover

181+ SOC 2 audit firms and 12 compliance automation platforms. Nothing else.

Adjacent frameworks (ISO 27001, HIPAA, PCI DSS, and seven more) show up only where they intersect with a SOC 2 decision. Reference explainers live in our frameworks hub; recurring buyer questions live in the SOC 2 buyer guides. General-purpose GRC tools that are not built for SOC 2 buyers are not here.

The scope stays narrow because broad directories are useless to anyone with a real decision to make. If a tool or firm does not affect SOC 2 scope, cost, readiness, evidence collection, or auditor selection, it does not belong in the core review set.

How we evaluate auditors

The license first. Active AICPA status, current peer review cycle, and no open enforcement actions. A firm that fails any of these does not make the directory.

Then pricing. Not what the firm publishes; what clients actually pay. We collect quoted ranges from direct submissions, shared RFPs, and post-engagement reports. Three data points minimum before a range goes live.

Then timelines. Kickoff to issued report, reported by clients who have finished the audit. Vendor estimates do not count.

Then fit. Industries served, company sizes, tech stacks, and co-sourcing partners. A firm that is right for a 200-person fintech is often wrong for a 12-person AI startup. We say which is which.

We also separate what a firm can sign from what it can support. CPA licensing and peer review determine whether a firm can issue a report; the assigned team's cloud, SaaS, security, and platform experience determines whether the engagement will be smooth for a specific buyer.

How we evaluate software

Three rules govern software reviews.

We log in. If a platform refuses a trial or live demo, we write that in the review. Every time.

We cross-check pricing. Three or more buyer-reported quotes are required before a range goes live. Marketing-site numbers are placeholders, not prices.

We find what is broken. Every review has a section on what does not work. If we cannot write one, we have not looked hard enough, and the review is not ready to publish.

How we rate

We do not.

We do not use 5-star scores or 4.3-out-of-5 averages. Star ratings compress too much. A platform that is excellent for your situation remains excellent even if its average score is middling, and a mediocre fit stays mediocre even at 4.8.

Every platform on the software hub is matched to the scenarios it actually fits. Every auditor in the directory has a fit profile: industries, company sizes, strengths, and known gaps. The recommendation is always "this one, for this buyer, for this reason."

Source-class tiers: how much each kind of evidence counts

Four classes of evidence are ranked by weight. Where two sources disagree, the higher tier wins. Cost ranges with their per-entry sources live at /soc-2-audit-cost/sources/.

Tier 1: regulatory and licensing text: AICPA peer-review records, board-of-accountancy CPA-license rosters, FedRAMP marketplace listings, CREST registry entries, and AICPA Trust Services Criteria. Treated as fact and cited directly with a permalink to the public registry where possible.
Tier 2: vendor-published primary documents: A firm's own service descriptions, a platform's own pricing page, or an audit report shared with us by a buyer under NDA. Heaviest weight after Tier 1. Sourced and dated on the entry.
Tier 3: buyer-side aggregates: 500+ RFPs from companies running real SOC 2 selection processes, contributed directly by buyers or anonymized partner programs, plus anonymous-ballpark requests routed through this site. Surfaced as ranges, never as point estimates, and cross-checked against Tier 1 and Tier 2 before publishing.
Tier 4: signal data: LinkedIn hiring patterns for enterprise traction reads, G2 and Trustpilot clusters for consistency, and public earnings commentary. Never used on its own, only as a cross-reference to Tier 1, Tier 2, or Tier 3 evidence.

Any data point older than six months, or based on a single Tier 3 or 4 source, gets flagged inline with its age and source.

What "last verified" means on an auditor profile

Every auditor profile carries a Last verified date. That stamp asserts three things on that date: the firm is still operating under the listed name, the AICPA peer-review record we link to is current, and the public-website pricing or scope signals still match what the firm publishes.

It does not assert that the firm's quoted pricing is current to the dollar. Audit fees move with scope, headcount, and timeline. The verified date is for structural facts, not the quote a firm would write today.

Cadence: every profile gets re-checked at least every six months. We re-check sooner on three triggers: a peer-review status change, a leadership departure flagged by a reader, or a pricing claim being challenged in writing.

A firm can request an off-cycle re-check by emailing hello@soc2auditors.org. Buyers can flag a stale stamp the same way.

Verification cadence triggers

Every profile is re-checked at least every six months. Four events pull a profile out of that cadence and into an off-schedule re-check.

Peer-review status change. The directory's source of truth for a CPA firm's standing is the AICPA peer-review database. Any change there pulls the profile into the queue within five business days.
Leadership departure. Named partners and methodology leads are part of a firm's fit profile. A departure surfaced by a reader, a vendor announcement, or a public filing triggers a re-check.
Pricing change documented in writing. A quote shared with us, a buyer-side RFP, or a vendor pricing-page update. If the change moves the firm's range by more than 20 percent in either direction, we re-anchor the entry and the cost-sources page.
Material business event. Funding round, acquisition, merger, regional expansion, or a security incident reported by the firm or its customers. Tier classification or stated capacity may shift.

When we update

We update when something real changes: a pricing shift, a new framework supported, a leadership departure, a security incident, or a feature added or removed. We do not update to hit a publishing calendar.

If nothing meaningful changed in six months, the page keeps its date. Every article carries the date it was last touched and what changed.

Changes to this rulebook:

May 13, 2026: Added source-class tiers, verification cadence triggers, and how-we-make-money sections. Expanded the sponsorship firewall from four bullets to seven.
April 2026: First public version. Prior commitments applied internally since launch; this page made them visible and enforceable.

How we make money

Three revenue streams. None buys a rating, a softer review, or routing priority over a better-fit firm. The firewall above is the whole game.

Paid Partner Pilot for audit firms: Audit firms pay a flat 90-day fee. In return they get priority on buyer briefs that match their categories, a profile rewrite around those categories, and a guarantee tied to one qualified buyer opportunity. No commission. No per-lead fee. Buyers are not charged and never see paid status as a quality signal. See the Paid Partner Pilot.
Sponsored placement: Occasional sponsored slots on specific pages: a software-hub section, a comparison page, or a directory category. Labeled in line with the listing. The label is the deal. Sponsorship does not move a rating or rewrite fit-profile copy. Ask about sponsored placement.
Affiliate links: A few platforms on the software hub pay a small share of net-new revenue. Disclosed where it applies. Same firewall as auditor sponsors: the share does not move a rating or pick winners in a comparison. Software vendor inquiries.

Corrections

Wrong price, stale license status, factual error, disputed quote? Email hello@soc2auditors.org. Screenshots help for pricing disputes; a recent quote beats our aggregated range every time.

We respond within two business days. Factual corrections go live within five. We do not silently edit; every correction gets a dated note at the bottom of the affected article so a reader can see what changed and when.

Disagreements on judgment calls, including which platform fits which scenario or how we read a weakness, are fair game to argue, and sometimes we revise. Email the argument.

Peter Korpak, founder.

Questions about a specific review, a partnership, or a pricing submission: hello@soc2auditors.org.

How we review SOC 2 auditors and software.