How we review SOC 2 auditors and software.

What we cover

174+ SOC 2 audit firms and 26 compliance automation platforms. Nothing else.

Adjacent frameworks (ISO 27001, HIPAA, PCI DSS, and seven more) show up only where they intersect with a SOC 2 decision. Reference explainers live in our frameworks hub; recurring buyer questions live in the SOC 2 buyer guides. General-purpose GRC tools that are not built for SOC 2 buyers are not here.

The scope stays narrow because broad directories are useless to anyone with a real decision to make. If a tool or firm does not affect SOC 2 scope, cost, readiness, evidence collection, or auditor selection, it does not belong in the core review set.

How we evaluate auditors

The license first. We check active CPA and AICPA standing and, for US firms, the AICPA peer-review record. Directory and profile pages show the exact public result — Pass, Pass with Deficiencies, Fail, result not public, or review not shown — rather than collapsing anything short of Pass into Enrolled. A missing public result is not a Fail: AICPA publishes ratings only for specified members or firms that opt in. Where we cannot confirm a record, the firm stays listed with a caveat badge and ranks below firms that clear the bar. We flag what we cannot verify, we do not hide it.

The ranked best SOC 2 auditors shortlist has a narrower admission rule. A US firm qualifies only when its latest accepted AICPA peer-review rating is Pass, verified in the public file or from the peer-review report and acceptance letter supplied to our research team. Enrollment without a verified rating does not qualify. Neither Pass with Deficiencies nor Fail clears the shortlist; a firm can return after a newer accepted review records a Pass.

Then pricing: a mix of figures firms confirm to us, public sources, and our own estimates, refreshed periodically. We prefer what clients actually pay (direct submissions, shared RFPs, and post-engagement reports) over published rates, and surface ranges rather than point estimates. Where a number is our estimate rather than firm-confirmed, the entry says so.

Then timelines: our estimate of kickoff-to-report duration, drawn from each firm's published engagement descriptions and refined from client interviews where we have them. Vendor marketing estimates do not count.

Then fit. Industries served, company sizes, tech stacks, and co-sourcing partners. A firm that is right for a 200-person fintech is often wrong for a 12-person AI startup. We say which is which.

We also separate what a firm can sign from what it can support. CPA licensing and peer review determine whether a firm can issue a report; the assigned team's cloud, SaaS, security, and platform experience determines whether the engagement will be smooth for a specific buyer.

How we evaluate software

Three rules govern software reviews.

We source every claim. Every platform in the registry carries an evidence state, a source URL, and a retrieval date for each renderable fact. Claims are checked against vendor docs, marketplace listings, and independent write-ups.

We cross-check pricing. We check published pricing against buyer-reported quotes where we have them and surface a range rather than a single number. Marketing-site figures are placeholders until real quotes back them.

We find what is broken. Every review has a section on what does not work. If we cannot write one, we have not looked hard enough, and the review is not ready to publish.

How we rate

We do not.

We do not use 5-star scores or 4.3-out-of-5 averages. Star ratings compress too much. A platform that is excellent for your situation remains excellent even if its average score is middling, and a mediocre fit stays mediocre even at 4.8.

Every platform on the software hub is matched to the scenarios it actually fits. Every auditor in the directory has a fit profile: industries, company sizes, strengths, and known gaps. The recommendation is always "this one, for this buyer, for this reason."

Source-class tiers: how much each kind of evidence counts

Four classes of evidence are ranked by weight. Where two sources disagree, the higher tier wins. Cost ranges with their per-entry sources live at /soc-2-audit-cost/sources/.

Tier 1: regulatory and licensing text

AICPA peer-review records, board-of-accountancy CPA-license rosters, FedRAMP marketplace listings, CREST registry entries, and AICPA Trust Services Criteria. Treated as fact and cited directly with a permalink to the public registry where possible.

Tier 2: vendor-published primary documents

A firm's own service descriptions, a platform's own pricing page, or an audit report shared with us by a buyer under NDA. Heaviest weight after Tier 1. Sourced and dated on the entry.

Tier 3: live briefs and quotes

Two datasets, kept separate. Buyer side: 500+ RFPs and matching briefs from companies actually choosing a firm or platform — scope, expectations, questions, and doubts. Supplier side: 2,000+ quotes from audit firms and software vendors — price, offered scope, and the solution they proposed. Both counts grow as new briefs and quotes arrive. Surfaced as ranges, never as point estimates, and cross-checked against Tier 1 and Tier 2 before publishing.

Tier 4: signal data

LinkedIn hiring patterns for enterprise traction reads, G2 and Trustpilot clusters for consistency, and public earnings commentary. Never used on its own, only as a cross-reference to Tier 1, Tier 2, or Tier 3 evidence.

Every price carries a source marker (our estimate versus firm-confirmed), and auditor profiles carry a last-verified date, so you can see how old a number is and where it came from.

What "last verified" means on an auditor profile

Every verified auditor profile carries a Last verified date. That stamp asserts three things on that date: the firm is still operating under the listed name, the AICPA peer-review record we link to is current, and the public-website pricing or scope signals still match what the firm publishes.

It does not assert that the firm's quoted pricing is current to the dollar. Audit fees move with scope, headcount, and timeline. The verified date is for structural facts, not the quote a firm would write today.

Cadence: we aim to re-check every profile quarterly, and sooner on three triggers: a peer-review status change, a leadership departure flagged by a reader, or a pricing claim being challenged in writing.

A firm can request an off-cycle re-check by emailing hello@soc2auditors.org. Buyers can flag a stale stamp the same way.

Verification cadence triggers

We aim to re-check every profile quarterly. Four events pull a profile out of that cadence and into an off-schedule re-check.

1. Peer-review status change. The directory's source of truth for a CPA firm's standing is the AICPA peer-review database. Any change there pulls the profile into the queue within five business days.
2. Leadership departure. Named partners and methodology leads are part of a firm's fit profile. A departure surfaced by a reader, a vendor announcement, or a public filing triggers a re-check.
3. Pricing change documented in writing. A quote shared with us, a buyer-side RFP, or a vendor pricing-page update. If the change moves the firm's range by more than 20 percent in either direction, we re-anchor the entry and the cost-sources page.
4. Material business event. Funding round, acquisition, merger, regional expansion, or a security incident reported by the firm or its customers. Tier classification or stated capacity may shift.

When we update

We update when something real changes: a pricing shift, a new framework supported, a leadership departure, a security incident, or a feature added or removed. We do not update to hit a publishing calendar.

If nothing meaningful changed in six months, the page keeps its date. Every article carries the date it was last touched and what changed.

How we make money

Audit firms, service firms, and software platforms can pay a flat advertising or sponsorship fee. We do not take a commission, referral fee, or cut of a buyer's contract. What money never buys is the answer: not a rating, not a softer review, not a "best for" a product does not fit, and not priority over a better-fit firm. The order is fit-first. The firewall above is the whole game.

Featured and Leader, for audit firms

An audit firm pays a flat advertising fee: Featured at $2,000/mo (billed quarterly, cancel any quarter) or Leader at $5,000/mo (one-year term, one firm per niche). It buys a profile we build and keep current, labeled placement on the pages buyers read, and a monthly visibility report. Search and answer engines choose sources and re-rank them independently; no paid page position buys an AI answer position. Featured HTML on static listing pages is evaluated at site build; an expired placement drops on the next deploy. The guarantee is an exposure floor, not a delivered lead: a paid firm is placed on at least a set number of fitting buyer shortlists each month, or that month is free. It is a shortlist placement, never a promise of signed deals. Buyers are never charged and never see paid status as a quality signal, and the lead matcher reads no payment field: fit and verified quality decide who surfaces, never who paid. See the tiers and how the guarantee works.

Featured and Category Sponsor, for service firms

Readiness, pentest, vCISO, ISO 27001, and compliance firms, the ones that prepare you for an audit but do not sign the report, pay a flat fee for an enhanced, labeled listing: Featured at $600/mo or sole Category Sponsor at $1,500/mo. Service firms are a separate pool from auditors and are not in the lead matcher, so the fee buys a badge and labeled placement only, never sort order or routing. See the service-firm tiers.

Sponsored-first rows on the software hub and segment shortlists

On the software hub and its segment shortlists, a platform can pay to move its existing row to the top only after the payment-blind canonical directory or cohort already includes it. The row is labeled Sponsored and a visible order note names the sponsor-first default. Payment cannot add a row, change the answer or primary picks, rewrite fit copy, or affect a review verdict or score. Segment cohorts of one to four platforms support one seat, while cohorts of five or more support up to two; every remaining member keeps its authored order.

Sponsored alternative notes on review, comparison, and alternatives pages

On review, comparison, and alternatives pages, the placement is a self-contained Sponsored alternative note at a relevant decision point. It states the fit and a material caveat, links to our independent review first, and never enters a comparison table, rating, ranking, or verdict. The label is the deal: sponsorship does not rewrite the answer. Ask about sponsored placement.

Flat-fee sponsorship, on software

Software platforms can pay for labeled, fit-gated placement on the pages they genuinely qualify for. The fee is fixed and does not depend on clicks, trials, leads, purchases, or contract value. Outbound platform links may carry our own analytics tags, but they do not pay us a commission.

Corrections

Wrong price, stale license status, factual error, disputed quote? Email hello@soc2auditors.org. Screenshots help for pricing disputes; a recent quote beats our aggregated range every time.

We respond within two business days. Factual corrections go live within five. We do not silently edit; every correction gets a dated note at the bottom of the affected article so a reader can see what changed and when.

Disagreements on judgment calls, including which platform fits which scenario or how we read a weakness, are fair game to argue, and sometimes we revise. Email the argument.

Peter Korpak, founder.

Questions about a specific review, a partnership, or a pricing submission: hello@soc2auditors.org.