How much should a CPA firm charge for a SOC 2 audit?

The results for the query your clients search are written for them, which makes them little use as a costing exercise. Quote off them and you are pricing against a buyer’s expectation instead of your own hours. The fee is usually not the mistake. The mistake is assuming the unpredictable part of the work is the testing.

Start from hours, not from what the market will bear

A fee you cannot decompose into hours is a guess wearing a rate card. The breakdown below is worth reading even where you disagree with the rates it assumes, because it works up from staffing rather than back from a market rate.

• One published practitioner breakdown puts a Security-only Type 2 at 60 to 80 auditor hours, at partner rates of $250 to $350 per hour and staff rates of $100 to $175, giving a stated floor near $9,000. Source.

Read that as a floor, not as a target. It assumes one Trust Services Criteria category,¹ a cooperative client, and a scope that does not expand after the engagement letter is signed. Add categories and the hours move. Add a client who has never been examined before and they move again, in the one direction you cannot bill for. What the buyer side of that fee is told to expect is set out in what the auditor fee actually covers, which is worth reading mainly because your prospect has probably read something like it already.

Where the hours actually go

Break a small engagement into the work it genuinely contains. The last four items are the ones an estimate gets right. The first three are where the optimism lives.

Scoping and planning

System description, boundary, subservice carve-outs, criteria selection. Cheap when the client knows their own architecture. Expensive when they do not, and you find that out in week three rather than week one.

The request list

Building a prepared-by-client list is fast. Making it legible to an engineer who has never seen one is not. Every ambiguous request line becomes two emails later.

Evidence chasing

Requesting, receiving the wrong artifact, explaining, requesting again. Unbounded in theory, unbillable in practice, and the largest single source of variance on a small engagement.

Testing

Sampling, inspection, reperformance, exception handling. This is the most predictable part of the work, which is exactly why it is the wrong thing to worry about.

Workpaper documentation

Tying evidence to criteria so a reviewer, a peer reviewer, or your successor can follow the conclusion without you in the room to narrate it. That bar comes from the attestation standards.²

Review and sign-off

Partner time at partner rates. Compressed review is where documentation errors survive all the way to issuance.

Report drafting and issuance

Narrative, exceptions, dates, management letters. Mechanical when the workpapers are clean. A rewrite when they are not.

Realization leaks in the chasing, not in the testing

A complex control is bounded work: you scope it, test it, document it, and then it is finished whether it took two hours or six. A client who sends the wrong screenshot three times is unbounded. Each round trip costs a reply, a context switch, and a re-read of the request you already wrote, and none of that is defensible on a fee note.

Firms price for the testing and lose the year on the wrangling.

So price the client, not only the control set. Two engagements with identical scope will not consume the same hours, and what separates them is almost entirely how the evidence arrives. You can tell which one you have inside the first two weeks. Ask for three specific artifacts before you quote, because how they come back tells you more than the questionnaire ever will.

Year two is a different engagement, so price it differently

A roll-forward year is not last year at a discount. Some of the work genuinely disappears. Some of it only looks like it did, and setting year two as a flat percentage of year one gets both halves wrong at once.

When to decline

Declining is a pricing decision, and it is the cheapest one available to you. Three cases are worth a firm no.

1. No infrastructure ownership. If the client cannot change the control environment they are describing, because it belongs to a parent, a managed provider, or a platform they resell, you are being asked to opine on somebody else’s system.
2. A report date that cannot be reached. Work backwards from the period, the fieldwork, the review, and the issuance. If the date the client already promised their buyer sits inside that arithmetic, say so before the engagement letter, not during fieldwork. The client-side version of that arithmetic is how long SOC 2 takes.
3. A client who cannot produce evidence. Test this before you sign. Send the three-artifact request above, set a deadline, and treat what comes back as the most reliable data you will ever get about the engagement.

There is a fourth case, which is quoting so far below your own floor that the only way to deliver is to stop doing the work. The reputational mechanics of that are documented rather than hypothetical.

• Linford and Company warns buyers to be careful when a compliance tool has a partner audit firm with a set fee far below other bids, citing a case where one firm issued the same form report to every client with only the names changed. Source.

That warning is written for buyers and should be read by firms. The buyer-facing version of the same argument sits at is a cheap audit legitimate, which tells a client what to ask you to prove. Being asked those questions is good for you.

How our own plan sits against that floor

It is a fair question to put to us, because our customer plan includes a SOC 2 Type 2 examination every year. Orbit is our floor, and it is narrow by design: the Security category only, a company of up to fifty people, and evidence and workpapers prepared on the platform before the firm opens the engagement. The firm re-performs the testing and forms its own opinion. It does not spend the engagement collecting evidence, which is the chasing that leaks realization in the published breakdown above.

Anything wider is not Orbit. Another Trust Services category, more than fifty people or a third framework is quoted as Mission before anyone signs, because the hours move the way the floor says they do. The firm’s engagement fee sits inside the plan price and Polara pays it on the customer’s behalf, so no separate auditor invoice reaches the client. We do not publish what the firm is paid, and we do not ask a firm to work below its own floor, which is the case the low-fee warning describes.

Choose software for the work you sell

Choose the engagement type first. Test the review. Inspect the report.

This guide explains SOC 2 practice economics. Polara Enterprise now focuses on ISO 27001 internal auditors and small consulting practices, and does not offer a new SOC 2 sales track. Existing customer records and contracted entitlements are preserved.

Compare a prospective tool against your engagement type, review workflow and portability requirements. Count migration and review time as part of the cost, not just the license.

The current ISO internal audit offer is on the Enterprise page. If you want to see the client side of this before you decide anything, the consumer SOC 2 pricing is published in full, which is the same standard we are asking you to hold us to.