Who Can Perform
a SOC 2 Audit?

Only a licensed CPA firm can perform a SOC 2 examination and issue the report. SOC 2 is an AICPA attestation engagement, so the firm signing the opinion must be independent, licensed by a US state board of accountancy, and enrolled in peer review. Consultants, platforms, and non-CPA “certifiers” can prepare you — but they cannot issue the opinion. The rule follows from what a SOC 2 actually is. SOC stands for System and Organization Controls, an AICPA framework, and a SOC 2 is not a certificate anyone can award — it is an examination performed under the AICPA’s attestation standards, culminating in a written opinion. Attestation is regulated public accountancy, which is why the attestation your customers rely on can only come from a CPA firm. That one fact sorts the whole market: the opinion comes from the CPA firm; everything else — readiness consulting, automation tooling, badges — is preparation.

• Licensure — the firm holds a current license or registration with a US state board of accountancy, and the report is issued in the firm’s name.
• Independence — the firm must be independent of your organization under the AICPA Code of Professional Conduct, in fact and in appearance, for the whole engagement and period covered.
• Peer review — the firm must be enrolled in the AICPA peer-review program, under which another CPA firm periodically inspects its accounting and attestation practice.
• Due professional care — planning, supervision, professional skepticism, and sufficient appropriate evidence behind the opinion, as the attestation standards require.

In practice, engagement teams blend CPAs — who own engagement acceptance, supervision, and the opinion — with IT-audit specialists holding CISA, CISSP, or cloud-security credentials, who perform much of the control testing. That blend is normal and desirable: testing access reviews across a modern cloud stack is specialist work. The line to hold is the signature, not the staffing: the opinion is rendered in the name of the licensed CPA firm, never an individual credential-holder. A CISA practicing alone cannot issue a SOC 2; a licensed CPA firm employing CISAs issues most of them.

Readiness consultants do the preparation: gap assessment against the Trust Services Criteria, control design and remediation, policy drafting, evidence preparation, and project-managing the path to fieldwork. What they cannot do is examine their own preparation. Under the AICPA Code’s independence and nonattest-services rules, a firm that designs and implements your controls generally cannot then attest to those same controls where that impairs its independence — an auditor must never audit its own work. That rule is why the ecosystem splits into readiness on one side and independent examination on the other.

Compliance automation platforms — Vanta, Drata, Sprinto, Secureframe — are software: continuous evidence collection from your cloud stack, control monitoring, policy templates, task tracking. They compress readiness work that used to live in spreadsheets. But a platform is not an auditor either — the platforms are clear about this themselves, and each maintains a network of partner CPA firms who perform the actual examinations. Subscribing to a platform buys tooling, not an opinion.

The CPA firm is the examiner: it scopes the engagement, tests the controls, evaluates exceptions, and signs the opinion under AT-C 205. It is the only party in the chain whose signature makes the report a SOC 2.

Tranquility Cybersecurity sits deliberately on the readiness side of that line. Our SOC 2 services cover gap assessment, remediation, evidence preparation, and coordinating the examination through empanelled, independent licensed CPA firms — across 500+ audits delivered for clients in India, USA, UK, Australia & UAE, the opinion has always come from the CPA firm, never from us. That separation is what makes the finished report worth your customers’ reliance — the same reasoning behind the published criteria we disclose whenever we compare vendors.

• Confirm state-board licensure. Every US state board of accountancy maintains a public register — check that the firm’s license is current and in good standing.
• Ask about peer review. Enrollment in the AICPA peer-review program is required — ask when the last review was and what rating it received.
• Ask who performs the fieldwork. Partner and manager involvement is a quality signal; an engagement fully outsourced to unnamed contractors points the other way.
• Ask about volume and fit. How many SOC 2 examinations does the firm issue annually — and how many in your industry (SaaS, fintech, healthcare)?
• Confirm the deliverable. The report should carry the firm’s opinion under AT-C 205 — not a “certificate,” a “seal,” or a letter of completion.
• Watch the red flags. Fixed-price “certificates,” one-week SOC 2 examinations, and firms happy to design the very controls they will later test are all reasons to walk away.

Past the checklist, watch how the firm behaves before you sign. A good examiner opens with a real scoping dialogue — which Trust Services Criteria beyond Security belong in scope, where the system boundary sits, what the period should be — rather than quoting a flat price for an unexamined system. They set out sampling expectations and evidence formats before fieldwork, not during it. They talk plainly about exceptions — exceptions are a normal feature of Type 2 reports, and a firm that promises a clean report is describing its rubber stamp, not its rigor. And they are honest about timelines. One final norm: a readiness assessment before the examination is standard practice, not an admission of weakness — it is how you avoid paying examination rates to discover gaps a consultant would have flagged months earlier.