What a SOC 2 auditor actually charges

A SOC 2 has two costs. One goes to a software company. The other goes to a licensed CPA firm, because a CPA firm is the only party permitted to examine your controls and sign an opinion about them.¹ That second fee is the one buyers never see broken out. Our full cost breakdown covers both together. This page is only about the auditor.

Two costs, two parties

Software cannot sign your report. That is a legal fact about attestation work in the United States, not a positioning choice by any vendor. The AICPA attestation standards put the examination in the hands of a licensed CPA firm,² and that firm carries the liability for the opinion it issues. Whatever platform you buy, someone with a license still has to do the work and put their name on it.

The two fees behave differently over time. A platform fee is a list price you could look up, at least in principle. An auditor fee is a quote, built from your scope and your mess, and it lands after somebody has looked at both.

Why the split stays hidden

Bundled quotes are easier to sell. A single number with no breakdown cannot be compared to anything, and a buyer who cannot compare tends to buy on trust. Watch what the market publishes instead. Vendors write confident dollar ranges for what a SOC 2 costs and no figure at all for their own half, and the receipts for that, with sources and the dates we read them, sit on the cost breakdown.

There is a second reason, and it is not cynical. A firm cannot quote you properly until it knows your scope, your headcount and how your evidence is kept, so any number offered before that conversation is a guess dressed as a price. The missing number is not the tell. The tell is a vendor who still will not separate it out after the scoping call, when there is nothing left to work out.

What actually drives the auditor’s hours

The rates are set by the firm and you will not move them. The hours are yours to influence, and on a company under fifty people three things move them more than everything else combined. None of the three is about how good your security is.

Scope

Every criterion you add is more tests, more samples, more evidence to review. Security is required. Availability, Confidentiality, Processing Integrity and Privacy are not,³ and each one you volunteer buys hours you will pay for. Read the customer contract that started all of this before you pick. A buyer asking for a SOC 2 without naming a category is asking for Security. The criteria guide walks through what each one obliges you to prove.

Evidence quality

Auditors do not bill much for reading a clean screenshot. They bill for the round trip when the screenshot is wrong. Evidence that arrives mapped to a control, dated inside the period, and named so a stranger can find it again tests in minutes. The same evidence delivered as forty unsorted files in a shared drive takes an afternoon per control. That gap is the biggest lever a founder has.

How much follow-up you cause

Fieldwork stalls on the client, almost always. A request goes out, the person who owns the answer is mid launch, a week passes, and the auditor reopens the file and reloads the context. Every reopen is billable. A named owner for each control and a same week response habit will do more for your fee than any tool you buy.

What Polara charges, and who invoices you

Star is $2,000 one time: the platform, the gap analysis, policies written from your own stack, and the evidence binder, with no Type 1 examination at that price. When you are ready, add a Type 1 report for $2,000 more, and it adds the examination performed by an independent partner auditor, a licensed U.S. CPA firm. You get one invoice. Nothing from the CPA firm arrives later, and no line item appears once you are already committed.

Orbit is $7,800 a year. It carries the audit as well as the monitoring: your SOC 2 Type 2 audit is included in every contract year, and each one starts once the 3-month observation window completes. How it works walks the sequence in order. Preparation is the part on your clock: audit-ready starting at about a week. The examination is the auditor’s.

No Type 2 audit has a price of its own: it sits inside Orbit, which is the honest shape of a fee we do not set ourselves.

We will not publish the split inside that number, so score us honestly on our own test below: four out of five. The total is the part you can hold us to. It does not move, and the other four answers are already on this page.

Why the price includes a licensed firm’s examination

A price like this invites an obvious objection: a licensed firm cannot do the work for that. The worry is fair, and the hour count at the top of this page is one version of it.

There is a sharper version of the same worry, and it is worth reading in full:

• Linford and Company warns buyers to be careful when a compliance tool has a partner audit firm with a set fee far below other bids, citing a case where one firm issued the same form report to every client with only the names changed. Source.

Both are fair points, and the second is the risk that actually matters. A firm issuing the same report to everyone with the names swapped is worthless to your buyer, whatever it cost. Ask for the firm name before you sign the engagement letter, then look it up in its state board public license register.⁴ Our independence and ethics page sets out where the line between the platform and the examination sits, and why the platform never touches the opinion.

Five questions that force the split open

1. What is the auditor fee, as a separate number? If the answer is a range, ask what puts a company at the top of it.
2. Do I pay the CPA firm directly, or do you? Two invoices means two contracts and two renewal dates.
3. Is the first examination included, or quoted later? Later is where the second number appears.
4. Which criteria does that fee assume? A Security only quote and a five criteria quote are not the same product, and only one of them is what your buyer asked for.
5. What does the fee do in year two? Roll forward work is cheaper for the auditor. Ask whether any of that reaches you.

A vendor who answers all five in one email is worth your time.

The rest of the cost picture sits on four pages. SOC 2 certification cost answers the Type 1 question in the words buyers search with, whether a cheap SOC 2 audit is legitimate covers the low end, the SOC 2 cost calculator totals two years, and SOC 2 software that publishes its pricing lists the platforms that print a number.