SOC 2 Auditor Certification: Credentials and Firm Checks

The AICPA describes SOC services as CPA assurance offerings. Its notice warns about unlicensed practitioners, firms without peer-review enrollment and work that fails professional standards.

Identify the issuing entity

A readiness consultant or software provider may arrange an audit through a separate CPA practice. Ask which legal entity will issue the report, who is responsible for the engagement and which license or permit authorizes that practice. Match those details to the engagement materials and regulatory record.

In the US, NASBA's CPAverify provides a starting point for individual and firm license searches using participating boards' data. The CPA tab takes a jurisdiction and last name, with optional first name and license number. The Firm tab takes a jurisdiction and firm name. Confirm unclear results with the relevant board. Individual practice privileges and firm authorization are separate questions; location or a remote delivery model is not proof of either.

For an issuer outside the US, ask where it is authorized to practice and which reporting standards it will use. Verify those details with the relevant professional body.

Looking for your company's own SOC 2 report? Start with how to get a SOC 2 report. The SOC 2 terminology guide explains how to describe that result to customers.

What each credential requires

Experience and renewal rules differ, and they tell you what the letters show about a person. The requirements below come from each issuer's own pages.

CITP

The AICPA's CITP requires an unrevoked CPA license, AICPA membership in good standing and at least 1,000 hours of relevant business experience in the last five years. It shows a CPA with a technology focus, not experience on SOC examinations.

CISA

Passing the exam and five years of information systems auditing, control or security work, gained within the ten years before applying. A candidate has five years from passing to apply. To keep it, a holder reports 120 continuing education hours over three years, at least 20 in each year. ISACA's CISA requirements. CISA is the credential most closely built around IT audit work, but it does not show that the person has worked on a SOC 2 examination or knows the AICPA's criteria.

CISM

The same exam-plus-experience structure and renewal rules as CISA, with five years of information security management experience. Its subject is running a security program. On an audit team that helps with judging whether your risk management and incident response make sense, and it says little about testing controls.

CISSP

Five years of cumulative, full-time experience in two or more of eight security domains. A degree or an approved credential can cover one of those years, per ISC2's experience requirements. It is a security credential, not an audit credential: it shows breadth across the security field.

CCSP and CCSK

A CCSP requires five years in IT, three of them in cybersecurity and one in at least one of six cloud domains. A degree or the CCSK can cover one year, but only one year can be waived in total, per ISC2's CCSP requirements. The Cloud Security Alliance says its CCSK needs no work experience or prior qualification. Read a CCSK as evidence of study and a CCSP as study plus experience. Either matters most when your system runs on cloud infrastructure and the team has to test its configuration.

ISO 27001 Lead Auditor

PECB, which certifies ISO 27001 auditors, has four tiers. Passing the exam alone earns the Provisional Auditor tier, with no experience required. The Lead Auditor tier requires five years of work experience, two of them in information security management, and 300 hours of audit activity. The credential helps if you want ISO 27001 and SOC 2 evidence reviewed together, and says less about SOC 2 fieldwork on its own.

CISA exam pass versus active certification

ISACA separates passing the CISA exam from becoming certified. Candidates must also meet its experience and application requirements and maintain the credential. Ask whether the person holds an active CISA, has passed the exam or is still studying, then check the status with ISACA's verification service. The same applies to CISM.

Ask how the CISA holder's audit experience applies to your systems and what they will do on your engagement. A firm-wide credential percentage does not identify the people assigned to your audit.

Associate of ISC2 is not a CISSP or CCSP

Someone who passes the CISSP exam without the required experience becomes an Associate of ISC2 and has six years to earn it. An Associate is a person working toward the credential, so a proposal that lists them as a CISSP or CCSP overstates what they hold.

PECB Provisional Auditor versus Lead Auditor, and the IRCA register

A person who finished an ISO 27001 course or passed the exam may hold the Provisional Auditor tier, or only a completion certificate, and neither is a Lead Auditor. The PECB certificate names the tier. IRCA keeps a separate register of auditors, and a training-course certificate is not a place on that register.

Check which role a SOC 2 course teaches

PECB's Lead SOC 2 Manager training, for example, prepares people to establish, implement, manage and improve an organization's SOC 2 compliance program. That course teaches program management; it does not authorize its graduates to issue the independent examination report. Read the syllabus to check whether it teaches the work you need someone to do.

Check the completed peer-review result

The AICPA explains that peer review normally runs every three years and that deficiencies or a Fail result lead to remediation. Check the firm's corrective action and current standing before proceeding. The review rating alone does not prove that a board has revoked its license.

The AICPA also explains that enrollment information and review documents have different public-disclosure rules. Start with the Peer Review Public File. If the rating is not public, request the documents from the firm. Until you have them, record the result as unknown rather than assuming Pass or Fail.

Our peer-review guide explains how to read the results.

When to pause the evaluation

• The provider will not identify the issuing CPA practice or explain a mismatch with the license record.
• It presents enrollment as a completed Pass review, or a course certificate as issuing authority.
• It calls someone CISA certified, a CISSP or a Lead Auditor when the issuer would call them an exam passer, an Associate of ISC2 or a Provisional Auditor.
• It cannot give a certificate or member number for the people on your engagement, or says the lookup does not work for them.
• It cannot explain who will supervise and review the engagement work.
• It promises an audit opinion before examining evidence or declines to address independence concerns.

Judge the proposed team on its qualifications, experience and supervision. The absence of CISA alone does not disqualify a competent team, and a CPA + CISA combination does not guarantee report quality.

Source: AICPA Peer Review Public File. Search for Johanson Group and compare the identifying details. Recheck the current record before signing; the retrieval date above is separate from this article's update date. Our verification methodology explains how we record firm evidence.

Copy this credential request into your RFP

Record each answer with its source and check date. Leave an unresolved field as unknown; request clarification before treating it as verified.

SOC 2 audit teams review evidence, interview control owners, test controls and document conclusions. Managers and reviewers check that work before the report is issued.

Ask the proposed lead how they would test an access review, inspect a deployment approval or evaluate backup evidence in your systems. They should explain which evidence they would inspect, the period it covers, the test procedure and how they would evaluate an exception.

• What did the lead do on recent engagements with similar systems and scope?
• Who checks the sampling, evidence sufficiency and conclusions?
• Who takes over if the named manager leaves, and how does the team bring in a technical specialist?
• Is any person on the team employed by an affiliate or another company, and who supervises that work for the licensed firm?

Firms decide how to staff an engagement, so treat the roles below as patterns to ask about, not requirements. The fixed point is the licensed firm and the CPA responsible for the report. Everything below that line is worth asking about by name.

For fees, timelines and the wider selection process, use how to choose a SOC 2 auditor.

Ask the person or the firm for the identifier each lookup needs. A holder who cannot produce one is a flag in itself.

• CPA license. Search CPAverify as described under who can issue a SOC 2 report. Confirm the status is active and the name matches the engagement letter.
• CISA and CISM. ISACA's Verify a Certification page asks for the certification type, the certification number and the last name as it appears in the person's ISACA profile. The expiration date on the certificate reflects the three-year continuing education cycle. ISACA says that if the annual requirements are not met, the three-year certificate is no longer valid, and the tool shows the current status.
• CISSP and CCSP. ISC2 offers a member verification page. Ask the holder for the member ID to go with the name. Someone who passed the exam but lacks the experience is an Associate of ISC2.
• CCSK. The Cloud Security Alliance issues a digital badge for the certificate. Ask for the badge link.
• ISO 27001 Lead Auditor. PECB's certificate verification form checks an individual's PECB certificate, and the certificate names the tier. IRCA keeps a register of auditors that you can search by scheme (ISMS is the information security scheme), grade and country.

Write down the identifier, the date you checked and what the lookup showed. If a lookup is unavailable, ask the firm to confirm the credential in writing.

Look for supervised IT-audit, risk-advisory or controls-testing work at a CPA practice. CPA licensure is not required for every testing or technical role. If you want responsibility for issuing attest reports, check the applicable board rules and the firm's requirements for that role.

CISA covers information-systems auditing; CPA licensure has separate requirements that depend on the jurisdiction. You can sit the CISA exam before meeting ISACA's experience requirement. Check ISACA's application rules before planning when to apply for certification.

Find SOC courses in the AICPA's SOC resource hub. Choose training for the work you want to learn, alongside supervised experience and any licensing your role requires. For entry routes and career progression, see how to become a SOC 2 auditor.

Describe your credential status precisely: actively licensed, actively certified, exam passed or studying. Then show work you have actually performed, such as evidence inspection, IT-control testing or workpaper documentation. Keep client details confidential.

Ask prospective employers about supervision, review and access to SOC 2 engagements. For entry routes and where SOC 2 work happens, follow the career guide. For compensation, compare current postings for the specific location and role; firm tier alone does not establish a salary or working-hours range.

Does a SOC 2 auditor training certificate let me issue reports?

No. It documents training or the provider's credential requirements. For a US engagement, issuing authority depends on the licensed CPA practice and applicable professional requirements, not the course title.

Can a non-CPA work on SOC 2 audits?

Yes. Non-CPA team members can contribute technical analysis, testing and documentation under the issuing practice's supervision. CISA or CISSP does not let them issue an independent SOC 2 opinion outside that practice.

How do I verify a SOC 2 auditor's credentials?

Start with the issuing firm and the responsible CPA in CPAverify, then check each named team member's credential with its issuer, using the certificate or member number. The lookup for each credential is listed above. A person who passed an exam but has not met the experience requirement does not hold the credential yet.

Does AICPA membership prove a firm is qualified?

No. Check membership, state licensure, peer-review enrollment and the completed review separately. Membership is not a licensing decision or a Pass rating.

What if the firm's peer-review rating is not public?

Request the report and acceptance documents directly. The AICPA explains that review documents are publicly shared for certain program members and firms that volunteer to share. Absence of a public rating does not establish Pass or Fail.

What should I verify at renewal?

Recheck the issuing entity, license standing, any new peer-review result and the assigned team. Ask the firm to reassess independence if your provider relationships or its services have changed.

Use these definitions when reviewing an auditor's proposal and supporting documents.

The auditor directory and verification methodology explain the evidence held for listed firms. Inclusion alone does not establish that every check below has been completed.