Switching SOC 2 audit firms

Most published guidance on replacing an auditor is written for financial statement audits, where professional standards set out explicit predecessor and successor communication steps. SOC 2 sits elsewhere. It is an attestation engagement performed over a stated period,¹ and the binding constraint is time rather than paperwork. Before you move, read how long a SOC 2 report stays useful, because that answer sets your window.

How to switch SOC 2 auditors between report periods

You finish a period. The report is issued. You are now standing in a gap with no live engagement, and that gap is the cheapest place in the calendar to change firms. Nothing is half tested. Nothing is half sampled. The successor opens a clean period on its own first day, and the predecessor work is already closed out in a document you hold.

Send the successor your prior report early. It cannot rely on the conclusions inside it, but the report tells the new firm what was in scope, what the previous firm flagged, and what your control set looked like a year ago. Nothing else you can hand over shortens the scoping call as much, and it surfaces disagreements while they are still cheap to settle.

Mid period is the expensive case

A Type 2 opinion covers a stated period, and the firm signing it has to have tested that period itself. The predecessor’s testing cannot be inherited. That one fact is what makes a mid period switch hard, and no engagement letter or transition plan gets around it.

What the successor can sometimes do is test the earlier months itself, out of your records rather than out of the predecessor’s file. Whether that works depends on what your own systems still hold. So the question to put to a successor is not whether it will honor the period you planned. It is the earliest start date it can stand behind, in writing.

That leaves two moves, and neither is a handover. It can start a new, shorter period from the day it takes over. Or it can wait for your next period to open and cover that one properly. The first gives you a report sooner with less time behind it. The second gives you full coverage later, with a stretch of calendar in between that no report describes.

If you are switching because the current engagement is going badly, a short honest period still beats a long one you cannot stand behind. Read how the observation period works before you commit to a date, because a restarted window has a floor and that floor drives every promise you make to a customer.

What transfers and what does not

The confusion in most switching conversations comes from treating the engagement as one object that gets passed across. It is not. Some of it is yours, some of it belongs to a firm you are leaving, and one part of it belongs to nobody and expires.

Your evidence is yours. The workpapers are theirs.

A departing firm does not owe you its file, and asking for one wastes a week you could spend collecting the same facts from source. Three things are in play and only two of them are yours.

Evidence

Anything produced by your own systems and people. Cloud configuration, user access exports, onboarding tickets, vulnerability scans, board minutes. You generated it, you keep it, you hand it to whoever you like.

Workpapers

The firm record of what it tested, how it sampled, what it concluded and why. That belongs to the firm. A successor would not rely on them anyway, because it has to reach its own conclusions on its own evidence.

The report

Yours to hold and to share. A SOC 2 report carries a restricted use paragraph naming who may receive it.² Read yours before you forward it to a prospect.

Export your evidence before you give notice, not after. Access to a shared portal is a courtesy that ends when the engagement does, and a year of screenshots is far easier to download once than to rebuild from memory.

What the successor re-performs

Assume nothing carries. A new firm rebuilds its own basis for an opinion, and the parts of that work you can prepare for are the parts that decide how long the first engagement takes.

1. Scope and criteria. It confirms which trust services criteria are in scope³ and which systems sit inside the boundary. Scope drift between firms is common and it is where surprises live.
2. Control design. It reads your controls and forms its own view of whether they are designed to meet the criteria. A prior clean opinion is context, not a shortcut.
3. Sampling. It pulls its own samples across the period it observed. The predecessor samples support the predecessor opinion and nothing else.
4. Anything previously flagged. Every item the old firm recorded as a deviation gets fresh attention. How exceptions are handled covers what that looks like when it lands in a report.
5. Who signs. The firm and the partner both have to be eligible to sign the opinion. Who can actually sign a SOC 2 is worth checking before you engage, not after.

Timing is the whole cost

Two switches with identical paperwork can differ by half a year of coverage purely on the date they start. The numbers below are the ones that decide it, and none of them are negotiable once a period is running.

Through Polara Labs there is no separate auditor invoice to renegotiate when you move. The engagement fee for the independent partner auditor sits inside the price: Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year, each one starting once the 3-month observation window completes. The scope is the one you choose in the assessment, and the engagement letter names it. See the timeline for how those dates fall.

How to run the switch

Order matters more than speed here. Every step below sits where it does because doing it later costs something real.

1. Export everything first. Evidence, policies, the issued report, any request list history. Do it while you still have portal access.
2. Finish the period you are in, if you can. A completed period is an asset. An abandoned one is nothing at all.
3. Ask the successor exactly which dates it will cover. Get the start date in writing before you sign, because that date, not the signature, is what your customers are buying.
4. Tell your buyers before they ask. A short note saying the next report covers a new window lands far better than a discovered gap.
5. Keep the old report in circulation until the new one is issued. It stays useful right up to the point something replaces it.

Switching firms does not reset your compliance posture, and it does not erase what the previous report said. It changes who examines you and when. If the underlying controls are weak, a new firm finds the same weaknesses with fresher eyes. Fix the controls first. Then move.