What does a SOC 2 report cost? The cost drivers explained
A US prospect asks for your SOC 2 report, and the first question inside your company is what it will cost. As with ISO 27001, the auditor’s fee is only one part. The rest is the time it takes to get controls running and to keep evidence for the whole observation period.
Key takeaways
- SOC 2 is an attestation, not a certification. A licensed CPA firm issues a report on your controls against the AICPA Trust Services Criteria.
- Type II costs more than Type I, because the auditor tests whether controls operated over a period, typically three to twelve months.
- Scope drives the fee: the system you describe, the Trust Services Criteria you include and how you handle subservice organisations such as your cloud provider.
- Internal effort is usually the largest block, mostly in collecting evidence across the observation period.
- The report covers a past period, so most customers expect a new one every year.
1. The CPA firm
The audit fee depends on how much the auditor has to test. The main factors:
- Type I or Type II. A Type I report looks at the design of your controls at one date. A Type II report also tests whether they operated effectively over the observation period, which means more samples and more hours.
- Trust Services Criteria. Security is always included. Availability, processing integrity, confidentiality and privacy are optional. Add only what your customers need.
- Scope of the system. One product with standard cloud infrastructure is simpler to audit than several products, environments or locations.
- Subservice organisations. Most companies use the carve-out method for providers such as their cloud host: the provider’s controls are excluded and covered by its own SOC report. The inclusive method brings them into your report and your audit.
Ask every firm for a quote on the same scope and criteria, and check how many hours and which observation period each quote assumes.
2. Your team’s time
SOC 2 Type II needs evidence for every control across the whole period: access reviews, change approvals, onboarding and offboarding, backups, monitoring, incident handling, vendor reviews. If evidence is collected by hand, this becomes a recurring task for several people. Add the system description, which you write and the auditor tests, and management’s assertion.
3. Readiness and remediation
Most teams start with a readiness assessment against the criteria. It shows which controls are missing or not yet evidenced. Closing those gaps costs time and sometimes licences, for example for central logging or device management. The observation period should only start once controls actually run, because every gap during the period appears as an exception in the report.
4. Outside help and software
Consultants can run the readiness assessment and help with the system description. Compliance software can map controls to the criteria and collect evidence from your systems during the period. Both are optional. Their value depends on how much evidence you would otherwise collect by hand.
The recurring costs
A SOC 2 report describes a past period. Customers usually expect a current report each year, so the audit and the evidence collection repeat. Between report periods, some customers ask for a bridge letter, a statement from your management that the controls have not changed materially since the period ended.
How to keep the cost down
- Start with Security only, unless customers ask for more criteria.
- Keep the scope tight around the product customers buy.
- Use the carve-out method for cloud providers that have their own SOC report.
- Collect evidence automatically from your tech stack from day one of the period.
- Reuse controls across frameworks. If you also need ISO 27001, most controls overlap. Our guide on SOC 2 vs ISO 27001 explains how.
Our page on SOC 2 compliance shows how GetTeddy’s AI agents support each step, from mapping controls to evidence across the period.
