Is a cheap SOC 2 audit legitimate?

The objection is fair. Keep it. A report that costs almost nothing, arrives in days, and comes from a firm you cannot find in any license register is worth nothing to the buyer who asked for it, and it can cost you the deal it was bought to close. Fabricated SOC 2 reports exist. Real examinations priced well under the published averages also exist. Separating them is mechanical rather than a matter of instinct. If you want the money broken out first, what SOC 2 actually costs splits the software fee from the auditor fee, line by line.

The strongest version of the objection

We are not going to paraphrase this one charitably. The people best placed to make the argument do this work for a living, and they publish it openly: one practitioner breakdown of the hours a Security-only examination takes, and one CPA firm’s warning about what a fee below those hours actually buys.

• One published practitioner breakdown puts a Security-only Type 2 at 60 to 80 auditor hours, at partner rates of $250 to $350 per hour and staff rates of $100 to $175, giving a stated floor near $9,000. Source, checked 2026-07-30.
• Linford and Company warns buyers to be careful when a compliance tool has a partner audit firm with a set fee far below other bids, citing a case where one firm issued the same form report to every client with only the names changed. Source, checked 2026-07-30.

That warning is correct and it names a real failure mode. A form report is a document shaped like an opinion with no examination behind it. If a compliance tool has a partner firm on a fee that could not cover the hours, the report is the first thing to doubt, and the buyer reading it will doubt it too.

What is actually a red flag

Price is a signal. It is a weak one. These are the strong ones, and every one of them is visible in the document or in a public register:

• The firm is not named until after you have paid, or is never named at all.
• You cannot find the firm in the license register of any state board of accountancy.¹
• The opinion letter carries no letterhead and no signature.
• Section 4 describes test procedures in generic terms and never names your systems, your tickets or your evidence.
• There is no as-of date on a Type 1, or no period on a Type 2, or the period does not match what you told your buyer.
• The report asserts trust services criteria you never scoped.²
• Someone offers you a Type 2 with no observation window behind it.

None of those are pricing problems. A large engagement can produce every one of them, and paying more does not fix a single one. Cost and legitimacy move independently, which is why no price on its own settles the question.

Two fees, and only one of them should worry you

Almost every quote merges them into a single number and never says where the line falls. Pull them apart before you judge any of it.

The software fee

Gap analysis, policies, evidence collection, and the binder that goes to the auditor. Sales commission, marketing and margin all live in this line. A low number here tells you about a business model, not about an audit.

The auditor fee

What a licensed CPA firm charges to examine your controls and sign an opinion. Hours, at professional rates. A number here that could not pay for the hours is the actual warning sign, and it is the one Linford and Company is describing above.

So the useful question for a vendor is not “why is this cheap”. It is “who is the auditor, and what are they being paid”. Ask it in those words. A vendor that can answer both halves without a call is telling you the truth about its cost structure.

What the market actually publishes

Independent figures for the same outcome, each read on the date shown. They are worth citing precisely because none of these parties has any reason to flatter our number:

• Linford and Company, a CPA firm performing SOC 2 examinations, puts the range at $20,000 to $150,000 with a median around $30,000. Source, checked 2026-07-30.
• LowerPlane publishes $4,995 a year for its platform and states that auditor fees are separate, paid directly to an auditor it introduces, at a rate it puts at $8,000 to $15,000 for SOC 2. Source, checked 2026-07-30.

LowerPlane is the closest thing to a comparison, because it publishes a price at all. What it publishes is a yearly platform fee, with the auditor engaged separately at a rate its own page puts well above that fee. Ours is one number, paid once, with the examination and the engagement fee for the independent partner auditor inside it. Two published prices, two different shapes. Which shape a quote has is the thing to check before you compare it to anything.

Where the auditor hours actually go

On a small engagement the testing is not the expensive part. The chasing is. The auditor asks for evidence that quarterly access reviews happened. What arrives is a screenshot of an admin panel with no date and no reviewer. They ask again. A week goes by. Now repeat that for every control in scope and you have spent most of a budget on email.

Organized evidence removes that loop. When the package arrives complete, indexed, and mapped to the criteria being tested, the auditor spends the engagement testing rather than requesting, and the fee follows the hours. That is the whole pricing argument. Ask any CPA who has run a small SOC 2 what share of their time goes into evidence wrangling, and see whether the answer matches.

It is also why preparation runs on the timeline it does: audit-ready starting at about a week. The deterministic gap engine, the thirteen policy pack written from your own stack, and the evidence binder with its control mapping exist for that one purpose: the auditor receives a finished package on day one. Speed is a side effect. Completeness is the point.

How to verify a firm, including ours

1. Get the firm’s name in writing before you sign the engagement letter. A vendor that will not name the firm until after payment has already answered your question.
2. Check the license with the state board. Every U.S. CPA firm is registered with the board of accountancy where it practices, and those registers are public and free to search. One lookup covers most of them.³
3. Look at the opinion letter itself. Firm letterhead, addressed to your company, dated, and signed with the firm name. An unsigned letter is not an opinion.
4. Read Section 4 before anyone else does. That is where the tests live. You want procedures that name your systems, your evidence and your dates, control by control. Boilerplate that would fit any company is the form report the warning above describes.
5. Confirm the period and the criteria. A Type 1 carries an as-of date. A Type 2 carries a period. Check both against what you told your buyer, and check that the trust services criteria listed are the ones you actually scoped.

Not one of those five asks you to take anyone’s word for anything, ours included. Type 1 versus Type 2 covers which report your buyer is really asking for, because a perfectly legitimate report for the wrong scope still fails the review.

What Polara does, specifically

The firm performing your examination is disclosed on request before you sign the engagement letter. Ask, and you get a name you can look up in a public register that afternoon. The first verification step above only works if the name arrives before the commitment, so that is when it arrives.

We are paid the same whatever the opinion says. A qualified opinion costs us nothing and a clean one earns us nothing extra, so the financial interest that independence rules are written against is not there to begin with.⁴ Our independence and ethics position sets out the rest of it, including the things we will not do.

One limitation, before you have to ask. Polara Labs has not published customer counts, case studies or named clients. If a logo wall is what would settle this for you, there is not one here yet. Run the five checks on us instead; a state board record is harder to assemble than a logo.

If a report fails these checks

Tell your buyer before their reviewer finds it. Then ask the vendor, in writing, for the firm name and the state board record, and treat a non-answer as an answer. Recovering the money is worth attempting and usually slow. Starting again with a firm you can actually look up is cheaper than the deal you lose, and much cheaper than the second one.