Frank, Rimerman + Co.

Who is Frank Rimerman?

Frank, Rimerman + Co. LLP is a Palo Alto-based CPA firm, founded in 1949, with roughly 500-700 people across seven California and Utah offices; its SOC and ISO examination work sits inside a dedicated Risk Advisory & Assurance practice, not as a side offering of the tax and accounting business.

The firm has been embedded in Silicon Valley’s venture and technology community since the earliest days of the venture capital industry, and that client base — SaaS, software, fintech, life sciences, and venture-backed companies — is exactly who the Risk Advisory & Assurance group is built to serve.

Frank, Rimerman is also an independent member of Baker Tilly International, one of the ten largest global accountancy networks, giving it reach into 140+ territories for clients with cross-border audit or advisory needs, even though the SOC/ISO practice itself is delivered out of the US offices.

What credentials does Frank Rimerman actually hold?

Frank, Rimerman + Co. LLP is a licensed CPA firm and AICPA member, which is the baseline requirement for issuing a SOC report — a SOC 1, SOC 2, or SOC 3 attestation is only as credible as the CPA firm behind it.

The firm is enrolled in the AICPA Peer Review Program, and its most recent peer review, dated March 18, 2026, resulted in a pass rating for the engagement period June 1, 2024 through May 31, 2025. Buyers can verify this directly on the AICPA Peer Review public file search. A pass this recent is a meaningful signal — it means the firm’s SOC methodology was independently reviewed and cleared well within the current audit cycle.

What SOC reports does Frank Rimerman issue?

Frank, Rimerman’s Risk Advisory & Assurance group performs the full SOC family: SOC 1 (internal controls over financial reporting, typically used for SOX purposes), SOC 2 (Type I and Type II, covering security, availability, confidentiality, processing integrity, and privacy), SOC 3 (the public-facing condensed summary of a SOC 2), and SOC 2+, which layers additional criteria — most commonly ISO

27001 or HIPAA — onto a standard SOC 2 examination so a client only runs one evidence-collection cycle instead of two separate audits. The practice is led by Assurance and Advisory Partners Nelly Spieler and Jason Stork, and the firm advertises unlimited partner and manager access throughout the engagement rather than gating communication to a junior staff auditor.

Is Frank Rimerman an ISO 27001 certification body?

Frank, Rimerman’s real differentiator in the SOC 2 market is that it can carry a client from a SOC 2 report through to an ISO 27001 (and ISO 27701 privacy) certification under the same firm brand — a combination most SOC 2-only shops cannot offer in-house.

Get the structure right, because it matters for independence: the SOC attestation is issued by Frank, Rimerman + Co. LLP (the CPA firm), while the ISO and CSA STAR certifications are issued by Frank, Rimerman Information Security LLC, a separate legal entity that is affiliated with, but organizationally distinct from, the CPA firm. That separation is not incidental — ANAB accreditation for a certification body requires exactly this kind of structural independence from a firm’s advisory work, the same principle that keeps a CPA firm’s attest opinions clean of self-review risk.

Frank, Rimerman Information Security LLC is accredited by the ANSI-ASQ National Accreditation Board (ANAB) to certify against ISO/IEC 27001 (information security management) and ISO/IEC 27701 (the privacy extension to 27001, useful for GDPR-adjacent obligations). The firm’s marketing also references ISO 27017 (cloud security) and 27018 (PII in the cloud) as part of the “ISO family” it can assess against, but its stated ANAB accreditation covers 27001 and 27701 specifically — buyers who need a standalone 27017 or 27018 certificate should confirm current accreditation scope directly with the firm before assuming coverage. Being one of the small number of public accounting firms accredited as an ISO 27001 certification body is a genuinely uncommon capability; most SOC 2 audit firms partner out ISO work rather than issue it themselves.

Does Frank Rimerman cover CSA STAR?

Frank, Rimerman Information Security LLC also holds Cloud Security Alliance (CSA) accreditation to issue CSA STAR Level 2 Certification, which combines the ISO/IEC 27001 standard with the CSA’s Cloud Controls Matrix for a cloud-specific maturity assessment, and lists the firm on the CSA STAR Certified Auditors Registry.

This is pitched as a natural next step for cloud-native companies that already hold or are pursuing ISO 27001 and want a deeper, cloud-specific layer of assurance without a full separate audit cycle.

Which industries does Frank Rimerman actually serve?

The Risk Advisory & Assurance practice’s client base mirrors the firm’s broader technology and life sciences focus: SaaS and software companies, fintech, healthcare and health-tech, life sciences (pharma, biotech, medical device, digital health), and venture-backed companies generally.

The firm’s decades of work with Silicon Valley venture capital and growth-stage technology clients shape how its SOC and ISO teams scope and staff engagements — they are used to the pace and audit-readiness gaps typical of a company preparing for its first enterprise deal or funding round with a compliance requirement attached.

Which frameworks does Frank Rimerman cover?

Frank, Rimerman’s public service pages do not describe HITRUST, FedRAMP, StateRAMP, CMMC, or PCI DSS QSA work as part of the Risk Advisory & Assurance offering. Buyers whose roadmap includes any of those frameworks should plan on a separate specialist firm for that scope, at least until Frank, Rimerman publishes evidence of accreditation in those areas.

How much does a Frank Rimerman SOC 2 audit cost?

Frank, Rimerman does not publish SOC 2 pricing. Directory estimates are $20,000–$60,000 Type I and $30,000–$80,000 Type II; a combined SOC 2+ISO job costs more than either alone.

Request a quote for a firm-specific number.

How long does a Frank Rimerman SOC 2 audit take?

Fieldwork-to-report for a SOC examination at Frank, Rimerman runs an estimated 4-12 weeks, though that window covers only the audit itself.

A SOC 2 Type II additionally requires an observation period — typically 3 to 12 months of continuous control operation — before fieldwork can even begin, a constraint of the SOC 2 standard itself rather than anything specific to this firm. Combining SOC 2 with an ISO 27001 or CSA STAR certification in one coordinated engagement is the practice’s stated goal of reducing duplicate evidence requests, but it does not shorten either framework’s underlying observation-period requirements.

Who is Frank Rimerman a good fit for?

Frank, Rimerman fits Bay Area SaaS, fintech, and life-sciences buyers that want a 75-year CPA name plus an affiliated path to ISO 27001/27701 and CSA STAR Level 2. HITRUST, FedRAMP, and PCI QSA are not in the published scope.

Best fit for:

• SaaS, fintech, healthcare/health-tech, and life sciences companies in Frank, Rimerman’s home Silicon Valley/Bay Area market that want a recognized, 75-year-old CPA firm name on the report
• Companies that will need both a SOC 2 report and an ISO 27001 (or 27701) certification and want that continuity handled by one affiliated firm rather than two unrelated

vendors - Cloud-native companies already holding or pursuing ISO 27001 that want to add CSA STAR Level 2 without starting a new audit relationship - Venture-backed startups whose deal or funding timeline benefits from a firm fluent in the Silicon Valley investor and enterprise-buyer context - Buyers who value direct, unlimited partner-and-manager access over being routed to junior staff

Not a fit — look elsewhere if:

• You need HITRUST, FedRAMP, StateRAMP, CMMC, or PCI DSS QSA work; none of these appear in Frank, Rimerman’s published scope
• You want the very lowest-cost boutique SOC 2 shop; a mid-tier regional CPA firm’s overhead puts it above the cheapest specialist auditors
• Your business has no California/Bay Area or broader life sciences/technology footprint and gets no benefit from the firm’s regional network

When should a buyer shortlist Frank Rimerman?

Shortlist Frank, Rimerman for a March 2026 AICPA peer-review pass plus an in-house path from SOC to ISO 27001/27701 and CSA STAR Level 2 via Frank, Rimerman Information Security LLC. That continuity is the mid-tier Bay Area pitch, not a HITRUST or FedRAMP shop.

For a Bay Area SaaS, fintech, or life sciences company that expects both a SOC 2 report and an ISO certification, that continuity is the reason to pay mid-tier pricing. For HITRUST, government frameworks, or the cheapest SOC 2, look to a specialist instead.