What a SOC 2 auditor actually charges

A SOC 2 has two costs. One goes to a software company. The other goes to a licensed CPA firm, because a CPA firm is the only party permitted to examine your controls and sign an opinion about them.¹ That second fee is the one buyers never see broken out, and it is often the larger half of a first year quote. Our full cost breakdown covers both together. This page is only about the auditor.

Two costs, two parties

Software cannot sign your report. That is a legal fact about attestation work in the United States, not a positioning choice by any vendor. The AICPA attestation standards put the examination in the hands of a licensed CPA firm,² and that firm carries the liability for the opinion it issues. Whatever platform you buy, someone with a license still has to do the work and put their name on it.

The two fees behave differently over time. A platform fee is a list price you could look up, at least in principle. An auditor fee is a quote, built from your scope and your mess, and it lands after somebody has looked at both.

Why the split stays hidden

Bundled quotes are easier to sell. A single number with no breakdown cannot be compared to anything, and a buyer who cannot compare tends to buy on trust. Watch what the market publishes instead. Vendors write confident dollar ranges for what a SOC 2 costs and no figure at all for their own half, and the receipts for that, with sources and the dates we read them, sit on the cost breakdown.

There is a second reason, and it is not cynical. A firm cannot quote you properly until it knows your scope, your headcount and how your evidence is kept, so any number offered before that conversation is a guess dressed as a price. The missing number is not the tell. The tell is a vendor who still will not separate it out after the scoping call, when there is nothing left to work out.

What actually drives the auditor’s hours

The rates are set by the firm and you will not move them. The hours are yours to influence, and on a company under fifty people three things move them more than everything else combined. None of the three is about how good your security is.

Scope

Every criterion you add is more tests, more samples, more evidence to review. Security is required. Availability, Confidentiality, Processing Integrity and Privacy are not,³ and each one you volunteer buys hours you will pay for. Read the customer contract that started all of this before you pick. Most buyers asking for a SOC 2 want Security and nothing else. The criteria guide walks through what each one obliges you to prove.

Evidence quality

Auditors do not bill much for reading a clean screenshot. They bill for the round trip when the screenshot is wrong. Evidence that arrives mapped to a control, dated inside the period, and named so a stranger can find it again tests in minutes. The same evidence delivered as forty unsorted files in a shared drive takes an afternoon per control. That gap is the biggest lever a founder has.

How much follow-up you cause

Fieldwork stalls on the client, almost always. A request goes out, the person who owns the answer is mid launch, a week passes, and the auditor reopens the file and reloads the context. Every reopen is billable. A named owner for each control and a same week response habit will do more for your fee than any tool you buy.

What Polara charges, and who invoices you

Type 1 is $4,000 one time. That covers the platform, the gap analysis, thirteen policies written from your own stack, the evidence binder, and the first examination performed by an independent partner auditor, a licensed U.S. CPA firm. The engagement fee for that firm sits inside the number. You get one invoice. Nothing from the CPA firm arrives later, and no line item appears once you are already committed.

After Type 1, monitoring runs $600 per month on a 12-month term, or $6,000 for the first twelve months on a single invoice, two months free versus paying monthly. Each Type 2 examination is $5,000, including your first, and it opens once the 3-month observation window completes. How it works walks the sequence in order. Preparation is the part on your clock: audit-ready starting at about a week. The examination is the auditor’s.

We will not publish the split inside that number, so score us honestly on our own test below: four out of five. What our partner firms charge for an engagement is between them and us, and printing a band for it would tell you something about our margins and nothing about your audit. The total is the part you can hold us to. It does not move, and the other four answers are already on this page.

What an auditor fee actually comes to, and why ours is lower

A price this low invites an obvious objection: a licensed firm cannot work for that. It deserves a real answer, and the people publishing higher numbers make their case in public. Read them against the right engagement. The $4,000 price buys a Type 1, a design opinion with no sampling across a period. The hour count below is for a Type 2, which samples a period and takes more hours for exactly that reason. So it sets the ceiling on the objection, not the case.

• One published practitioner breakdown puts a Security-only Type 2 at 60 to 80 auditor hours, at partner rates of $250 to $350 per hour and staff rates of $100 to $175, giving a stated floor near $9,000. Source, checked 2026-07-30.
• Linford and Company warns buyers to be careful when a compliance tool has a partner audit firm with a set fee far below other bids, citing a case where one firm issued the same form report to every client with only the names changed. Source, checked 2026-07-30.

Both are fair points. The first is arithmetic, and arithmetic only holds if the hours hold: cut the round trips and the chasing out of a small engagement and the hour count is a different number. The second is the risk that actually matters. A firm issuing the same report to everyone with the names swapped is worthless to your buyer, whatever it cost. Ask for the firm name before you sign the engagement letter, then look it up in its state board public license register.⁴ That check takes four minutes. Our independence and ethics page sets out where the line between the platform and the examination sits, and why the platform never touches the opinion.

Five questions that force the split open

1. What is the auditor fee, as a separate number? If the answer is a range, ask what puts a company at the top of it.
2. Do I pay the CPA firm directly, or do you? Two invoices means two contracts and two renewal dates.
3. Is the first examination included, or quoted later? Later is where the second number appears.
4. Which criteria does that fee assume? A Security only quote and a five criteria quote are not the same product, and only one of them is what your buyer asked for.
5. What does the fee do in year two? Roll forward work is cheaper for the auditor. Ask whether any of that reaches you.

A vendor who answers all five in one email is worth your time. Most will not.