Is a cheap SOC 2 audit legitimate?

So keep the objection. A report that costs almost nothing, arrives in days, and comes from a firm you cannot find in any license register is worth nothing to the buyer who asked for it, and it can cost you the deal it was bought to close. Fabricated SOC 2 reports exist. Real examinations priced well under the published averages also exist. Separating them is mechanical rather than a matter of instinct, and the rest of this page is the mechanics.

Two fees, and only one of them should worry you

A quoted SOC 2 number merges two different purchases, and almost nobody says where the line falls. Pull them apart before you judge any of it. A low number means opposite things depending on which half it landed in.

The software fee

Gap analysis, policies, evidence collection, and the binder that goes to the auditor. Sales commission, marketing and margin all live in this line. A low number here tells you about a business model, not about an audit.

The auditor fee

What a licensed CPA firm charges to examine your controls and sign an opinion under the AICPA attestation standards. Hours, at professional rates. A number here that could not pay for the hours is the actual warning sign, and it is the one Linford and Company describes above.

So the useful question to put to any vendor is not “why is this cheap”. It is “who is the auditor, and is the examination inside the price or billed later”. Ask it in those words. If you want the money broken out line by line, what SOC 2 actually costs splits the same two fees with the published figures attached.

Five checks that settle it

These work on any vendor, this one included, and they run on documents you are entitled to see. Not one of them asks you to trust anybody.

1. Get the firm’s name in writing before you sign the engagement letter. A vendor that will not name the firm until after payment has already answered your question.
2. Check the license with the state board. Every U.S. CPA firm is registered with the board of accountancy where it practices, and those registers are public and free to search. One lookup covers most of them.³
3. Look at the opinion letter itself. Firm letterhead, addressed to your company, dated, and signed with the firm name. An unsigned letter is not an opinion.
4. Read Section 4 before anyone else does. That is where the tests live. You want procedures that name your systems, your evidence and your dates, control by control. Boilerplate that would fit any company is the form report the warning above describes.
5. Confirm the period and the criteria. A Type 1 carries an as-of date. A Type 2 carries a period. Check both against what you told your buyer, and check that the trust services criteria listed are the ones you actually scoped.

Run them in that order and the price question largely answers itself. The longer version, section by section, is how to tell if a SOC 2 report is real. Type 1 versus Type 2 covers which report your buyer is really asking for, because a legitimate report for the wrong scope still fails the review.

What is actually a red flag

Price is a signal. It is a weak one. These are the strong ones, and every one of them is visible in the document or in a public register:

• The firm will not be named before you sign the engagement letter, or is never named at all.
• You cannot find the firm in the license register of any state board of accountancy.¹
• The opinion letter carries no letterhead and no signature.
• Section 4 describes test procedures in generic terms and never names your systems, your tickets or your evidence.
• There is no as-of date on a Type 1, or no period on a Type 2, or the period does not match what you told your buyer.
• The report asserts trust services criteria you never scoped.²
• Someone offers you a Type 2 with no observation window behind it.

None of those are pricing problems. A large engagement can produce every one of them, and paying more does not fix a single one. Cost and legitimacy move independently, which is why no price on its own settles the question.

What the market actually publishes

Independent figures for the same outcome, each read from its own page. None of these parties has any reason to flatter a low number:

• Linford and Company, a CPA firm performing SOC 2 examinations, puts the range at $20,000 to $150,000 with a median around $30,000. Source.
• LowerPlane publishes three annual plans, Starter at $4,995, Growth at $9,995 and Scale at $15,995 a year, and states that auditor fees are separate and paid directly to your chosen auditor, with no auditor figure given. Source.

Look at the shapes rather than the totals. Linford is describing an examination fee. LowerPlane publishes yearly platform fees and then puts the auditor on a separate invoice, paid to the firm directly, with no figure for it anywhere on the page. Two published prices, two different shapes. A single quoted number can be either one, and which one it is decides whether the quote compares to anything at all.

Where the auditor hours actually go

In our experience a large share of a small engagement goes to requesting evidence rather than testing it. The auditor asks for evidence that quarterly access reviews happened. What arrives is a screenshot of an admin panel with no date and no reviewer. They ask again. A week goes by.

Organized evidence removes that loop. When the package arrives complete, indexed, and mapped to the criteria being tested, the auditor spends the engagement testing rather than requesting. Ask any CPA who has run a small SOC 2 what share of their time goes into evidence wrangling, and see whether the answer matches.

Which gives you a sixth question, and it is a good one to keep in your pocket. Ask a cheap vendor what it does to shorten the examination. A mechanism is an answer. A discount is not.

What a legitimate Type 2 path has to include, line by line

Whoever you buy from, a Type 2 has lines you cannot skip and lines you can. Separate them before you compare any quote. Three things are unavoidable. Everything else is a choice.

We do not sell the examination without the platform, so on our prices the optional line and the required one arrive together. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year.

That is our path, not the only one, and other vendors price the same lines in different shapes. Compare any quote against the three required rows rather than against our total. Running SOC 2 with no platform at all is also legitimate, and SOC 2 without a compliance platform lays out what that saves and what it costs in time. SOC 2 software that publishes its pricing lists the platforms you can price without a call, and what a SOC 2 auditor charges covers the firm side on its own. The SOC 2 cost calculator runs the same arithmetic across two years.

What we charge, and how to run the checks on us

Here is ours, now that there is something to judge it against. Star is $2,000 one time, and a Type 1 report is $2,000 more, for the Type 1 examination by the independent partner auditor. One invoice, not a platform fee with the audit billed later, which is why it does not line up cleanly against either shape above.

Preparation runs on the timeline it does for the reason described above: audit-ready starting at about a week. The deterministic gap engine, the policy pack written from your own stack (thirteen Security policies, plus one for each extra category you add, except Availability), and the evidence binder with its control mapping exist for that one purpose: the auditor receives a finished package on day one. Speed is a side effect. A shorter examination is the point.

Now run the five checks. The firm performing your examination is disclosed on request before you sign the engagement letter, so the name arrives while you can still walk away, and you can look it up in a public register that afternoon. We are paid the same whatever the opinion says. A qualified opinion costs us nothing and a clean one earns us nothing extra, so the financial interest that independence rules are written against is not there to begin with.⁴ Our independence and ethics position sets out the rest of it, including the things we will not do.

If a report fails these checks

Tell your buyer before their reviewer finds it. Then ask the vendor, in writing, for the firm name and the state board record, and treat a non-answer as an answer. Recovering the money is worth attempting and usually slow. Starting again with a firm you can actually look up is cheaper than the deal you lose, and much cheaper than the second one.