Menu
What we check
Verification confirms a firm exists as it claims and can do what a SOC 2 buyer needs. We check discrete public facts and firm-supplied documents, not audit quality or outcomes.
- State CPA licensure
- For US firms, that the firm is a licensed CPA firm able to legally issue (sign) a SOC 2 report, checked against state board-of-accountancy records. For non-US firms, that the firm issues SOC 2 reports rather than only preparing companies for one.
- AICPA Peer Review records
- For US firms, enrollment in the AICPA Peer Review Program, the public record that the firm’s own audit quality has itself been inspected. Where a rating is publicly disclosed, we show it. The program does not cover non-US firms, so we do not assert it of them.
- Firm documents and details
- Documents the firm provides and the structural facts on its profile: operating name, the date we last checked, and any client references on file.
How long verification lasts
A verification lasts 12 months from the date shown on the record. After that the badge automatically displays as expired until the firm re-verifies. Staleness can never render as current: the expiry is enforced server-side, not by a manual audit cycle.
When we revoke it
We withdraw verification when a verified fact lapses, for example a peer-review enrollment drops, a firm becomes readiness-only, or a client reference is found to be fraudulent. On learning a verified fact has lapsed, we flip the badge to expired within 7 days.
Verification cannot be purchased
Verification cannot be purchased: payment to SOC2Auditors.org never affects verification status. A firm earns the badge by clearing the checks above and keeping its facts current, never by paying us. This is the same firewall the directory runs on: credibility is earned, never bought.
Corrections and re-verification
A firm can request an off-cycle re-check, or a buyer can flag a stale record, by emailing hello@soc2auditors.org.