Original figures aggregated from the maintained SOC 2 audit-firm directory, plus public-data series with a separate computed date on every number. Charts, CSVs, and citations are free to reuse with attribution.
4.2× fee spread The Type 2 median is $137,500 for Big Four firms and $32,500 for specialists in the current directory snapshot.
Among 48 attestation-capable firms with verified records dated 2026-05-20 through 2026-08-20, the median Type 2 range midpoint is $43K. The p10–p90 span is $24K–$100K. Median fieldwork-to-report timing is 8 weeks, with a 4 weeks–12 weeks p10–p90 span.
| Metric | p10 | Median | p90 | Sample |
|---|---|---|---|---|
| Type 1 price midpoint | $12K | $25K | $68K | 48 |
| Type 2 price midpoint | $24K | $43K | $100K | 48 |
| Fieldwork-to-report midpoint | 4 weeks | 8 weeks | 12 weeks | 48 |
Price provenance in this sample: 5 firm-confirmed, 1 public, and 42 estimated. These are public-record planning estimates, not firm-confirmed quotes or a promise of what any engagement will cost.
Peer review uses a separate US-only denominator. 45 of 46 freshly verified US records had a current public-file check; 45 of those 45 were enrolled, and 32 disclosed a rating. Missing public-file records are not counted as “not enrolled.”
No licensing percentage is published. The registry has no normalized current licensing field that supports a defensible market percentage. Check the exact signing entity with its state board before hiring a firm.
Computed 2026-08-20 from our auditor directory. Type-7 percentiles use range midpoints; prices round to the nearest $1,000 and timelines to a whole week. A 10-record manual sample audit used the same dataset version.
The median SOC 2 Type 1 audit fee across the 174 firms we track is $37,500, with 80% of firms falling between $17,150 and $55,000.
Menu
Source: SOC2Auditors.org, https://soc2auditors.org/data/#type-1-median-cost (retrieved 2026-08-21). The median SOC 2 Type 2 audit fee across the 174 firms we track is $55,000, with 80% of firms falling between $28,950 and $100,000.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#type-2-median-cost (retrieved 2026-08-21). These are headline aggregates. See the full sourced cost breakdown by tier and add-on.
The median fieldwork-to-report window across the 174 firms we track is 9 weeks.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#median-audit-timeline (retrieved 2026-08-21). Of the 174 firms we track, the most common fieldwork-to-report window is 9 to 12 weeks, quoted by 86 firms.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#timeline-distribution (retrieved 2026-08-21). Estimate a timeline for your own scope with the SOC 2 timeline calculator.
90% of the 135 US-based SOC 2 audit firms we track are enrolled in the AICPA peer-review program.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#directory-firms-peer-review-enrolled (retrieved 2026-08-02). Among the 95 directory firms whose AICPA peer-review result is public (a member/opt-in subset, not the whole directory), the results break down as recorded; we do not extrapolate this to firms that do not disclose.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#peer-review-rating-disclosed-subset (retrieved 2026-08-02). Read the enrollment and disclosed-result analysis on the SOC 2 audit-firm data page.
We counted 4,823 active IT-audit job postings on company career sites across the US, UK, and Canada in 2026-08.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#it-audit-job-postings-total (retrieved 2026-08-02). Across audit and compliance roles, IT audit is the most common (4,823). Dedicated "SOC 2 auditor" titles are rare (1); demand surfaces as the broader roles. These are separate keyword searches with overlapping coverage, so we compare them rather than add them up.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#compliance-job-postings-by-role (retrieved 2026-08-02). Explore the country and role comparisons on the compliance hiring data page.
Across the 174 firms we track we record 78 distinct accreditation labels; the most common, AICPA, appears on 155 of them.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#accreditation-prevalence (retrieved 2026-08-21). 38% of the firms we track name at least one GRC platform they work with.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#grc-platform-support (retrieved 2026-08-21). The 174 firms we track operate across 7 countries.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#firms-by-country (retrieved 2026-08-21). 78% of the SOC 2 audit firms we track are based in the United States.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#share-us-based (retrieved 2026-08-21). Full-service CPA firms are the largest organization group among the 174 SOC 2 auditors we track, accounting for 94 of them.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#firms-by-type (retrieved 2026-08-21). The median firm we track reports a team of about 550 people.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#team-size-distribution (retrieved 2026-08-21). The median founding year among the firms we track is 1985.
Source: SOC2Auditors.org, https://soc2auditors.org/data/#founding-year-distribution (retrieved 2026-08-21). The internal figures on this page are computed from the directory of 174 SOC 2 audit firms. That is the attestation-capable set: a firm that only prepares clients for an audit, and cannot sign the report, is excluded here and listed on the readiness directory. Cost and timeline figures use each firm's published range midpoint. The page reports the median (p50) and, where stated, the 10th to 90th percentile band, so eight in ten firms fall inside it. Counts and shares are simple tallies over the same dataset. A firm missing a field is excluded from that figure's sample, never counted as a zero.
Our pricing figures are public-records estimates, not firm-confirmed quotes. They describe what firms publish and what the market reports, not a binding price for any engagement. A CPA firm sets the final fee after scoping your systems. Treat every number here as a planning aggregate with a known method, dated so you can judge how current it is.
The original June trust-page adoption series has been withdrawn from the public roll-up. Its regex could not reliably distinguish a company's own attestation from a vendor claim, and blocked pages could be counted as absent. The replacement attested-company index will publish only after a stratified 200-page calibration set is complete; until then, no adoption or platform-share figure is shown.
The audit-firm figures join US firms in the directory to the AICPA public peer-review file search. Enrollment is reported over the full matched US directory sample. Ratings are reported only for the member or opt-in subset whose result is public; disclosed results are not extrapolated to firms that do not disclose.
The hiring figures are a demand proxy, not a SOC 2 headcount. They come from a public job-postings index that crawls companies' own applicant-tracking-system career sites and matches title and department tokens. Separate role searches are compared rather than summed because their coverage can overlap, and the headline count uses IT audit alone across the US, UK, and Canada.
Each series is refreshed independently. The newest committed series was computed on 2026-08-21, and the oldest current series on this page was computed on 2026-08-02. Every figure carries its own computed date, so a newer directory snapshot cannot make an older external series appear fresh.
Maintained by Peter Korpak. Questions, corrections, or a stale number? Email hello@soc2auditors.org. Replies normally arrive within two business days.
Cite freely with attribution. This dataset is published under CC BY 4.0. Reuse any figure, chart, or CSV as long as you credit SOC2Auditors.org and link back to soc2auditors.org/data. Each figure above has a one-line citation you can copy.
Share the scope to receive a shortlist of fitting firms, then compare their ballparks and timelines against the medians above.