A SOC 2 report is issued by a CPA firm, not by a software platform. The AICPA describes SOC as a suite of services CPAs may provide. But platforms increasingly offer to arrange the audit, and some sit in the same company as the auditor. For a team switching platforms, the audit route can change as much as the software.
Source: AICPA SOC suite of services · read 2026-07-27
How do the platforms describe their audit routes?
- Thoropass: automation and audit in one company, with in-house auditor support and an audit offering led by an audit partner it describes as ex Big 4 and Coalfire.
Source: Thoropass homepage · read 2026-07-27
- Scytale: Built-In Audit with partner auditors and an audit hub; its expert manages the audit process with your chosen auditor.
Source: Scytale audit management · read 2026-07-27
- Vanta: a Vanta Audit product, and a startup page stating 26k audits completed with AICPA peer-reviewed auditors.
Source: Vanta for startups · read 2026-07-27
- Secureframe: access to the Secureframe Audit Partner Network on Fundamentals.
Source: Secureframe pricing · read 2026-07-27
- Sprinto: Sprinto network auditor access, or bring your own auditor, with audit management.
Source: Sprinto pricing · read 2026-07-27
- Drata: auditors as part of its partner network.
Source: Drata partners · read 2026-07-27
- Scrut: an AI Internal Auditor Teammate; an external audit route is not described on the pages we read.
Source: Scrut homepage · read 2026-07-27
- Comp AI: audit needs are a pricing factor; the auditor route is not described on the pages we read.
Source: Comp AI pricing · read 2026-07-27
What has the profession published?
The AICPA and its Journal of Accountancy published several items on SOC engagements in 2026. We cite their titles and dates only:
- 1 February 2026, Journal of Accountancy: "Promises of 'fast and easy' threaten SOC credibility".
- 13 April 2026, AICPA Ethics Staff Insights: "Business arrangements with SOC tool providers".
- 30 April 2026, Journal of Accountancy podcast: "The risks of quick-turn SOC engagements and what CPAs should know".
- 14 May 2026, Journal of Accountancy: "AICPA guides peer reviewers to address SOC 2 risks".
The titles alone set out the questions a buyer should ask: how fast is too fast, what business arrangements exist between the auditor and the tool, and how the auditor's own work is reviewed.
What are the trade-offs of one company?
One company for audit and automation can mean fewer hand-offs and an auditor who already knows the platform's evidence. Some buyers prefer a separate audit firm so that the people testing controls have no stake in the tool. Both preferences are reasonable. The point is to choose deliberately and ask the questions below either way.
What should you ask any auditor?
- Is the firm a licensed CPA firm, and is it enrolled in AICPA peer review?
- What business arrangements does the firm have with the platform vendor: referrals, revenue share, ownership?
- Who does the fieldwork, and what will they test directly rather than accept from the platform?
- How long will the engagement take, and why?
Does switching platforms mean switching auditors?
No. Most routes above allow your own auditor, and keeping the auditor you have is usually the lower-risk choice during a platform switch. If your new platform's audit route is part of why you are moving, introduce the new auditor before the period starts, not during it.
What should you write down before you decide?
Record which audit route you chose, why, and the answers each auditor gave to the questions above. Keep the note with your contract. If a customer or a future auditor asks how the audit was arranged, the answer is on file rather than in someone's memory, and the next platform decision starts from facts you have already checked.