Who Can Issue a SOC 2 Report? Why It Has to Be a Licensed CPA Firm

Only a licensed CPA firm can perform a SOC 2 audit and issue the report. A security consultancy or a compliance software vendor cannot sign one, however skilled its team is. The rule comes from the AICPA, which owns the SOC 2 framework and wrote the attestation standards the examination runs under. State accountancy law backs it up. If you are comparing SOC 2 audit firms, the signing firm's license is the first thing to check, because the customers asking for your report will check it too.

This guide covers who can perform a SOC 2 audit, where the CPA requirement comes from, what other providers are allowed to do, and how to confirm a firm's credentials yourself.

Who can perform a SOC 2 audit?

A SOC 2 audit is an attestation examination, and the report is issued in the name of a CPA firm that holds a firm license from a US state board of accountancy. That firm must also be independent of the company it examines.

The requirement attaches to the firm and to the signature. It does not mean every person on your engagement is a CPA. Most SOC 2 auditors work in mixed teams: CPAs alongside IT auditors and security specialists, many of whom hold credentials such as CISA or CISSP. The Cloud Security Alliance's explainer on the CPA requirement makes the same point: non-CPAs often sit on the engagement team, while the report itself is signed by the CPA firm.

So when someone asks who can perform a SOC 2 audit, the precise answer has two parts. Qualified specialists can do much of the testing. A licensed CPA firm has to plan the engagement, supervise the work, form the opinion and sign the report.

Why a SOC 2 report has to come from a CPA firm

Four things sit behind the rule, and each one is a protection for the people who will read your report.

• The AICPA owns the framework
  
  SOC 2 is an AICPA product. The AICPA wrote the Trust Services Criteria your controls are measured against, and it wrote the attestation standards that govern how the examination is performed and reported. A CPA SOC 2 audit is carried out under those standards, mainly AT-C sections 105 and 205. They are written for practitioners in public accounting, which is why the opinion page of every SOC 2 report says the examination followed attestation standards established by the AICPA.

• State law reserves attest work for licensed firms
  
  In the US, accountancy is regulated state by state. The Uniform Accountancy Act is the model most states base their laws on, and it provides that attest services may only be rendered through firms holding a state permit. A SOC 2 examination is attest work. A company that signs one without a firm license is outside professional standards and may also be breaking state law.

• Independence is mandatory
  
  The AICPA Code of Professional Conduct requires a firm performing attest work to be independent in fact and in appearance. In practice, the firm that gives an opinion on your controls cannot be the firm that designed or runs them. A consultant who built your security program has every reason to say it works. An independent auditor does not.

• Someone audits the auditor
  
  CPA firms that perform attest engagements must keep a documented system of quality control and go through peer review, where another CPA firm inspects their work. A review ends in one of three ratings: pass, pass with deficiencies, or fail. If a firm ignores professional standards, a complaint can go to its state board of accountancy, which has the power to discipline it or pull its license. No equivalent oversight exists for an unlicensed provider.

What consultants, security firms and compliance platforms can do

Plenty of providers sell SOC 2 help. Most of them do useful work, but only one type can issue the report.

Two situations cause most of the confusion.

The first is the bundled offer. A platform or consultancy advertises "SOC 2 in one package," and the audit is passed to a partner firm in the background. That arrangement is allowed. What you need to know is the legal name of the CPA firm that will sign, because that name is what your customers will see on the opinion.

The second is the firm that does both readiness and the audit. A CPA firm may assess your readiness and later perform the examination, as long as it stays out of management's role. It can point out gaps. Your team decides how to close them and operates the controls. If the same firm designed your controls or runs them for you, its independence is impaired, and it should not sign the report.

If you are still deciding which kind of help to hire first, our guide on choosing between a SOC 2 auditor and a consultant covers that decision.

Does the CPA firm have to be in the United States?

Your company can be anywhere. A SaaS business in Bengaluru or Berlin can get a SOC 2 report in the same way as one in Austin. What matters is the firm that signs: it needs to be a CPA firm licensed by a US state board of accountancy.

A chartered accountant qualification from another country does not meet that requirement by itself. An Indian CA or a UK chartered accountant can work on the engagement, and many do, but the report goes out through a licensed US CPA firm.

Outside the US, accounting firms issue similar assurance reports under ISAE 3000, the international standard from the IAASB. Those reports can be measured against the same Trust Services Criteria. Whether a US buyer will accept one in place of a report issued under AICPA standards is the buyer's decision, so ask your customer's security team before you choose. If most of your pipeline is American, a US-licensed CPA firm is the safer choice.

How to check SOC 2 auditors before you sign

You can verify most of this yourself, and every check below uses a public record or a document the firm should hand over without hesitation.

1. Get the legal name of the signing firm. The brand on the proposal and the entity on the opinion are sometimes different. Ask which CPA firm will sign and in which state it is licensed.

2. Look up the firm's license. Every state board of accountancy runs a public license search. NASBA's CPAverify tool covers many states in one place. Confirm the firm's permit is active, and check the engagement partner's individual license too.

3. Check peer review. The AICPA keeps a public file of peer review records for enrolled firms. Ask the firm for its latest peer review report and rating, and whether SOC engagements were part of the practice that was reviewed.

4. Ask who does the testing. Find out who the engagement partner is, how many SOC 2 examinations the team has completed, and whether any fieldwork is subcontracted.

5. Ask about independence. List every other service the firm or its affiliates provide to you. Ask about referral arrangements with any platform or consultant that introduced you.

6. Read a sample report. A redacted report shows whether the system description and tests are written for that client or copied from a template.

The last check matters more than it used to. In February 2026 the Journal of Accountancy reported on concerns within the AICPA's SOC 2 Working Group about boilerplate reports from high-volume providers. Members of the group advised buyers to vet a firm's qualifications, peer review results, sampling approach and independence before engaging it. One of them noted that a report a customer rejects has no value to the company that paid for it.

A licensed firm is the minimum. Among licensed SOC 2 audit firms, the quality of the work still varies, and these questions are how you tell them apart.

What a genuine SOC 2 report looks like

You can tell who issued a SOC 2 report from the report itself. The section titled "Independent Service Auditor's Report" carries the opinion. It states that the examination was conducted under attestation standards established by the AICPA, and it ends with the CPA firm's name, its city and state, and the date.

The rest of the report supports that opinion: management's assertion, a description of your system, and, in a Type 2 report, the auditor's tests of each control with the results. Our breakdown of SOC 2 report structure goes through each section.

There is also no SOC 2 certificate. SOC 2 is an attestation, and what you receive is a report containing a CPA firm's opinion. People say "SOC 2 certified" as shorthand, and that is fine in conversation. A badge or one-page certificate with no report behind it and no CPA firm named on it is not a SOC 2, and a customer's vendor risk team will treat it that way.

Work with a CPA firm that signs its own SOC 2 reports

Accorp Partners is a licensed US CPA firm. We perform SOC 2 Type 1 and Type 2 examinations and issue the report under our own name, so the firm you speak to during scoping is the firm on the opinion page.

Run the checks in this article on us before you decide. Ask for our firm license details and our peer review record, then compare them with any other SOC 2 audit firms on your shortlist. You can start on our SOC 2 audit services page or contact our team with your scope.

Frequently asked questions

1. Can a non-CPA firm perform a SOC 2 audit?

No. A non-CPA firm can prepare you for the audit and its specialists can assist a CPA firm's engagement team. It cannot issue the report. Only a licensed CPA firm can sign a SOC 2 opinion.

2. Does every SOC 2 auditor on my engagement need to be a CPA?

No. Many SOC 2 auditors are IT audit or security professionals without a CPA license. The engagement partner who takes responsibility for the opinion is a CPA, and the report is signed in the firm's name.

3. Can the same firm do my readiness assessment and my audit?

Yes, if it is a CPA firm and it keeps to an advisory role during readiness. It can tell you where the gaps are. It cannot design the controls, operate them, or make management's decisions and then give an opinion on the result.

4. Do I need a Big Four firm?

No. Any licensed CPA firm enrolled in peer review can perform a SOC 2 examination. What your customers look at is the license, the quality of the report and whether the firm has real SOC experience. Firm size is not on that list.

5. Can my compliance automation platform issue the report?

No. The platform gathers evidence and tracks your controls. A CPA firm, sometimes one the platform introduces you to, performs the examination and signs. Ask for that firm's name before you commit.

6. Is a SOC 2 report from a firm outside the US valid?

It depends on who signs. If the engagement runs through a US-licensed CPA firm under AICPA standards, the location of the team does not matter. If a non-US firm issues it under ISAE 3000 instead, check with your customer before relying on it.