How we review SOC 2 auditors and software.

What we cover

180+ SOC 2 audit firms and 12 compliance automation platforms. Nothing else.

Adjacent frameworks (ISO 27001, HIPAA, PCI DSS, and seven more) show up only where they intersect with a SOC 2 decision. Reference explainers live in our frameworks hub; recurring buyer questions live in the SOC 2 buyer guides. General-purpose GRC tools that aren't built for SOC 2 buyers aren't here. The scope stays narrow because broad directories are useless to anyone with a real decision to make.

How we evaluate auditors

The license first. Active AICPA, current peer review cycle, no open enforcement actions. A firm that fails any of these doesn't make the directory.

Then pricing. Not what the firm publishes — what clients actually pay. We collect quoted ranges from direct submissions, shared RFPs, and post-engagement reports. Three data points minimum before a range goes live.

Then timelines. Kickoff to issued report, reported by clients who've finished the audit. Vendor estimates don't count.

Then fit. Industries served, company sizes, tech stacks, co-sourcing partners. A firm that's right for a 200-person fintech is often wrong for a 12-person AI startup. We say which is which.

How we evaluate software

Three rules.

We log in. If a platform refuses a trial or live demo, we write that in the review. Every time.

We cross-check pricing. Three or more buyer-reported quotes before a range goes live. Marketing-site numbers are placeholders, not prices.

We find what's broken. Every review has a section on what doesn't work. If we can't write one, we haven't looked hard enough — the review isn't ready to publish.

How we rate

We don't.

No 5-star scores. No 4.3-out-of-5. Star ratings compress too much — a platform that's great for your situation stays great even if its "average" score is middling, and a mediocre fit stays mediocre even at 4.8.

Every platform on the software hub is matched to the scenarios it actually fits, and the ones it doesn't. Every auditor in the directory has a fit profile — industries, company sizes, strengths, known gaps. The recommendation is always "this one, for this buyer, for this reason." Not a number.

Source-class tiers: how much each kind of evidence counts

Four classes of evidence, ranked by weight. Where two sources disagree, the higher tier wins. Cost ranges with their per-entry sources live at /soc-2-audit-cost/sources/.

Any data point older than six months, or based on a single Tier 3 or 4 source, gets flagged inline with its age and source.

What "last verified" means on an auditor profile

Every auditor profile carries a Last verified date. That stamp asserts three things on that date: the firm is still operating under the listed name, the AICPA peer-review record we link to is the current one, and the public-website pricing or scope signals we cite on the profile still match what the firm publishes.

It does not assert that the firm's quoted pricing is current to the dollar. Audit fees move with scope, headcount, and timeline. The verified date is for the structural facts on the profile, not the quote a firm would write today.

Cadence: every profile gets re-checked at least every six months. We re-check sooner on three triggers: a peer-review status change, a leadership departure flagged by a reader, or a pricing claim being challenged in writing.

A firm can request an off-cycle re-check by emailing hello@soc2auditors.org. Buyers can flag a stale stamp the same way.

Verification cadence triggers

Every profile is re-checked at least every six months. Four events pull a profile out of that cadence and into an off-schedule re-check.

1. Peer-review status change. The directory's source of truth for a CPA firm's standing is the AICPA peer-review database. Any change there pulls the profile into the queue within five business days.
2. Leadership departure. Named partners and methodology leads are part of a firm's fit profile. A departure surfaced by a reader, a vendor announcement, or a public filing triggers a re-check.
3. Pricing change documented in writing. A quote shared with us, a buyer-side RFP, or a vendor pricing-page update. If the change moves the firm's range by more than 20 percent in either direction, we re-anchor the entry and the cost-sources page.
4. Material business event. Funding round, acquisition, merger, regional expansion, or a security incident reported by the firm or its customers. Tier classification or stated capacity may shift.

When we update

When something real changes. A pricing shift. A new framework supported. A leadership departure. A security incident. A feature added or removed.

Not to hit a publishing calendar. If nothing meaningful changed in six months, the page keeps its date. Every article carries the date it was last touched and what changed.

Changes to this rulebook:

• May 13, 2026. Added source-class tiers, verification cadence triggers, and how-we-make-money sections. Expanded the sponsorship firewall from four bullets to seven.
• April 2026. First public version. Prior commitments have applied internally since launch; this page makes them visible and enforceable.

How we make money

Three revenue streams. None of them buys a rating, a softer review, or routing priority over a better-fit firm. The firewall above is the whole game.

Corrections

Wrong price, stale license status, factual error, disputed quote? Email hello@soc2auditors.org. Screenshots help for pricing disputes — a recent quote beats our aggregated range every time.

We respond within two business days. Factual corrections go live within five. We don't silently edit — every correction gets a dated note at the bottom of the affected article so a reader can see what changed and when.

Disagreements on judgment calls — which platform fits which scenario, how we read a weakness — are fair game to argue, and sometimes we revise. Email the argument.