CPA firm registration, signing licenses and peer review are the starting point, not proof of quality. A practical guide to checking credentials and asking the questions that matter before choosing your SOC 2 auditor.
Since the DeepDelver investigation in March 2026, audit firm credibility has become a front-line question for enterprise buyers and the companies selling to them.
The fallout is more scrutiny of whether an audit firm holds the right credentials, and a lot of confusion about what those credentials actually mean. Some of the firms implicated were registered CPA firms enrolled in peer review. Credentials are the floor, not proof of quality.
Below are the questions we hear most from companies choosing a SOC 2 auditor, with straight answers, plus the questions worth asking before you sign.
The firm must be registered as a CPA firm with the board of accountancy in at least one US state. That is a specific legal designation: the state board licenses the firm itself, not just its individual accountants, to issue attestation reports like SOC 2.
A firm with capable auditors but no US CPA firm registration cannot issue a SOC 2 report under AICPA standards. To check, ask which states the firm is registered in, then look it up on that state board's license search or on CPAverify.
A CPA firm must be at least 51% owned by certified public accountants. Those owners must be licensed in one or more US states, in good standing and actively practicing.
The CPAs who sign your report must also hold active licenses. Ask who the signing CPAs are and which states license them, and consider verifying the one that will be signing your report.
Peer review is the profession's independent check on a CPA firm's quality management. Once registered, a firm doing attestation work like SOC 2 enrolls in the AICPA Peer Review Program. Another CPA firm then reviews its quality management system and a sample of its engagements.
The point is governance: an outside check that the firm does its work the way the standards require. Reviews recur every three years, so a firm's result reflects a point-in-time sample, not every report it signs.
Peer review looks back over 12 months of a firm's issued reports. A new firm has to complete engagements before there is anything to review, so its first peer review typically lands 18 months to two years after it starts.
A pending first review is normal for a new firm and not a red flag on its own. What matters is what else backs the firm in the meantime.
A firm's status is one of four, and any firm should be able to tell you which in one sentence.
| Status | What it means | What to ask |
|---|---|---|
| Pass | The reviewer found the firm's quality system suitably designed and followed | Can we see the report, and when is the next review? |
| Pass with deficiency(ies) | Broadly sound, with one or more deficiencies noted | What were they, and what has changed since? |
| Fail | Significant deficiencies in how the quality system is designed or followed | Why, and where is remediation up to? |
| Pending first review | A new firm not yet eligible for review | When is it due, and what other quality signals back the firm? |
No. Registration and peer review are necessary, but they don't prove your report will hold up with enterprise customers. Some of the audit firms implicated in the DeepDelver allegations were registered CPA firms enrolled in peer review.
Peer review samples a handful of engagements every three years; it can't vouch for each report a firm signs. The questions that tell you more are about how the firm does the work: who does it, how it is scoped, and what the firm will stand behind.
Look at the people behind the firm. Have its principals built or run a peer-reviewed CPA firm before? How experienced are the signing CPAs? Can the firm point to clients and enterprise customers who have relied on its partners' past reports?
Throughline is a new US-registered CPA firm, so our first peer review isn't due yet. Our co-founder previously built and sold AssuranceLab, a peer-reviewed CPA firm that served more than 1,200 clients before its acquisition. We know first-hand what peer review demands, and built our practice to meet it from day one.
Ask what the firm guarantees about the quality of its reports, and what it will do if an enterprise customer questions or challenges one. The answer shows whether the firm is prepared to stand behind its work.
Enterprises rarely send formal feedback on a report. But they do sometimes ask questions to get comfortable with the firm behind it, or about what they can and can't rely on. A credible firm will support you through those conversations, and tell you plainly what happens if a customer can't get the reliance it needs.
Practitioner experience is one of the biggest quality factors, and one of the least visible. Some firms run delivery through offshore teams or hand fieldwork to junior staff; others keep experienced practitioners on the engagement end to end.
Ask who will do your fieldwork and where they are based, who the signing CPAs are, and how much SOC experience each has. Ask whether the senior people you meet during sales will be involved after you sign. For why experience and continuity matter, read choosing a SOC 2 auditor: why the person leading your audit matters most. Security analysts at IANS also suggest checking a firm's US presence and how many clients it audits each year (IANS).
Templating was the clearest sign of poor quality in the DeepDelver findings. Reports were nearly identical across hundreds of companies, down to the same grammatical errors, with only names and logos swapped. All 259 Type II reports in the leaked set reportedly carried word-for-word identical auditor conclusions.
A credible SOC 2 report reflects the client's own systems, scope and risks. Enterprise reviewers spot a templated report quickly, because the control descriptions don't match how the company actually operates.
Ask how the firm aligns scope and controls to your environment, and whether it adapts controls to your size and stack or works from a fixed list. Confirm that the auditor designs and runs its own tests, and has no business relationship with your compliance platform vendor.
They can cover the same ground, but only a US CPA firm can issue a report under AICPA standards and use the AICPA SOC logo. Firms elsewhere may report on the same Trust Services Criteria under a different assurance standard, such as ISAE 3000 (international). Confirm which standard applies and whether it meets your customers' requirements.
Many enterprises treat these as equivalent. Some, particularly in the US, prefer an AICPA report, much as some buyers prefer American-made.
That matters when a firm is an audit firm in another country, or employs accountants qualified elsewhere, but isn't a US CPA firm. Its report may be perceived differently from an AICPA SOC 2, so ask which standard your report will be issued under.
10.How will you support us if a customer questions or challenges the report?
Credentials are the starting point. For the practical factors that make the report itself useful, read what makes a SOC 2 report quality. You can also compare audit approaches, or discuss your circumstances in a Compliance Strategy Workshop.
Ask how the firm approaches SOC 2 readiness assessments, including whether readiness feeds into the audit and how management ownership and auditor independence are maintained.
Former PwC manager, founder of AssuranceLab and former Sensiba partner and Chief Innovation Officer. Now co-founder of Throughline, focused on compliance and assurance for AI-native companies.
SOC 2 for AI-native companies: simpler stacks, agents running the program in your own tools, concise policies, and a report that covers AI in production.
ISO 42001 isn't yet an enterprise requirement. What it covers, how it compares with SOC 2 and AIUC-1, and when it's worth it for an AI company.
How to cover production AI agents in SOC 2: governance, access, change management and monitoring, with indicative criteria mappings, customer responsibilities and practical audit expectations.
Australian companies need a SOC 2 report issued under the AICPA standards by a US-licensed CPA firm, delivered by a strong local team in Australian time zones. Here's how the provider options compare, and what to check.
Experienced CTOs don't choose a SOC 2 audit firm on price or speed. They look for tech stack expertise, a tailored approach, flexible scheduling, responsiveness and year-round partnership, because those factors decide how much time the audit really costs.
What Security, Availability, Confidentiality, Processing Integrity and Privacy each cover, how often they're included, and how to decide which belong in your SOC 2 report.
Which SOC 2 report should come first? Six client cases, practical decision tables and an illustrative 18-month cost comparison explain when to start with Type 1 and when to go straight to Type 2.
How long a SOC 2 Type 2 observation period should be, how to work backwards from a customer deadline, when auditors test, why reports run late and how much buffer to build in.
A category-by-category SOC 2 budget in USD, covering audit fees, readiness, platforms, penetration testing, consultants, internal assessments and operational costs. Learn what is required, what is optional, and what a quote can leave out.
Five signals of real quality in assurance and security, with practical guidance on building a compliance program that supports customer TPRM, repeatable enterprise reviews and revenue growth.
The person leading your SOC 2 audit is the most underrated factor in choosing an audit firm. Companies compare price, timelines and platform integrations, then barely ask who will actually do the work.
SOC 2 is a risk report, not a certificate. Understand how enterprise customers use it, why having a report is only base camp, and how to turn your audit into a trust asset for growing revenue.
What readiness should cover, when to involve your auditor, which gaps matter most, and how readiness, Type 1 and Type 2 can work as one continuous engagement. A practical guide to preparing for a report your customers can rely on.
Neither is better for everyone. The right choice depends on your customers, how you run security and where you are headed. For AI-native and AI-centric companies, SOC 2's flexible criteria usually make it the stronger starting point.
There's a basic psychology behind why most people don't like audits. Fix this, and people are surprisingly happy to do them again.
Enterprise buyers use SOC 2 as an initial qualifier, then look deeper. A quality report is what carries you through that assessment and turns your compliance investment into real trust.
Audit quality isn't service quality, and it isn't only professional standards. The real test is whether a reader of your report thinks: this tells me what I need to know.
Enterprise security teams review you in the background and rarely give feedback. What they look at beyond SOC 2, what counts as a genuine pen test, and how a quality report does the heavy lifting.
Compliance from first principles, the 95% problem, the compliance metadata AI needs, rethinking screenshots, spreadsheets and policies, and why audits should meet clients where they are.