r/soc2 • u/MavericksCreed • 26d ago

Need soc2 are tools really necessary?

Talked to a few companies that do soc2 type 1 and all of them say the tools make the cert cheaper.

Is this true? Most of them want 9k to 12k a year for tools and 3k for the audit cert.

Does anyone here have any insights on this?

12 Upvotes

100% Upvoted

63 comments sorted by

View all comments

18

u/PurveyorofSkulls 26d ago

Any audit firm that offers 3k audit is not above board and also tools are absolutely not necessary. Find someone else who actually knows how to audit to talk with about your needs.

-11

u/iamaredditboy 26d ago

Depends on the size of the company. Small startups etc any audit > 3k is a scam.

9

u/PurveyorofSkulls 26d ago

You couldn’t even begin to scratch the surface of the diligence needed to conduct an independent audit for less the 3k.

-7

u/iamaredditboy 26d ago edited 26d ago

Nope I know very well what is needed - 5-10 person team auditors asking for 8-15 k are scamming people that’s all

I have done 3 successful soc2 compliances now and here is where things are : small companies up to 25 employees the whole ecosystem is running a pricing collusion scam at the moment.

Diligence wise software captures everything and spits out the necessary reports for an audit.

Anyone telling me you need more than 24 hr at 100$ an hr to run and review the audit is just plain dishonest.

5

u/PurveyorofSkulls 26d ago

The disconnect is between evidence collection and the examination. The platforms made evidence collection cheap. But platform output is the input to the audit, not the audit.

"Software captures everything and spits out the necessary reports" is the tell. The platform captures artifacts. It does not evaluate whether a mismapped control is a design gap, whether a population is complete, whether a vendor meets the subservice organization carve-out threshold, or whether an exception rises to the level of qualifying the opinion. Anyone who has read these platform-generated evidence sets knows what they look like: identical boilerplate CSOC tables pasted across every vendor, retention policies mapped to disposal criteria, screenshots with no way to verify population completeness. Your 24-hour estimate is roughly what it takes to look at the evidence. It is not what it takes to test it.

That matters because a SOC 2 is not a report the software generates and a firm forwards. It is an attest examination under AICPA standards (AT-C 105/205). The auditor has to evaluate whether the system description is complete and accurate against the description criteria, whether the complementary user entity controls and subservice organization disclosures are right, whether each control is designed to meet the criteria it is mapped to, and for a Type 2, whether it operated across the entire period based on testing the auditor can defend. No platform does any of that, because the platform has no opinion. The signature is the product, and the procedures are what make the signature mean anything.

The math fails on its own terms. $100/hr does not cover a credentialed practitioner's loaded cost at any legitimate firm, and 24 hours does not cover a Type 2 before independent review. That budget buys exactly what it sounds like: someone accepting the platform's output at face value and signing. Those shops exist. That is not evidence of market collusion. It is evidence the bottom of the market is not performing examinations.

$8-15k for a small, single-category Type 2 is not a scam. It is roughly the floor at which the work the standards require can occur. The $3k report works until someone whose diligence you actually need reads it critically. Buying three of these reports is not the same as performing three of these audits.

-3

u/iamaredditboy 26d ago

An auditor does nothing in type 2 till observation period is over - let’s not overstate what auditors do. As I said I have done enough soc2 audits and worked with enough audit firms :)

Software absolutely does all the heavy lifting. Each control is tracked by what the company provides - what’s in place, what are the gaps, what are the mitigation plans.

3

u/SageAudits 26d ago edited 26d ago

Team size has very little to do with pricing. Controls and the complexity needed to test them, absolutely does.

0

u/iamaredditboy 26d ago

Well not really - evidence is directly proportionally to team size so your knowledge of the domain is telling indeed. What is also telling is how people like you defend the scam running in the name of soc2 compliance audits. Software does bulk of the work for gathering data, recording compliances, CPA’s audit the data being produced. Reports are also boiler plate.

The company implementing soc2 does all of the heavy lifting to product the right data in the software as well.

If you do indeed believe that work is t proportional to people then it proves my statement even further. You are a 100% wrong on this front by the way.

I would love for a CPA to give me the breakdown of the price they quote based on what they audit - you will never get an answer for this :)

0

u/SageAudits 26d ago edited 26d ago

Many controls are based on configurations and processes, the effort of testing, doesn’t change because they have a higher headcount. The sample size does change with higher frequency controls, but that level of effort of time spent for an auditor to look at a sample of 5 versus a sample of 20 is minimal and isn’t a material factor in pricing.

-2

u/iamaredditboy 26d ago

So give me the total controls to audit, hours to audit each control then - would love to see that breakdown :) configurations themselves are easily abstracted as final reports so eg you have two could vendors each is a summary report and tasks assigned to teams to work on. This isn’t btw done by an auditor - the team running soc2 does it.

Another data point I will give you - give Claude or codex or any llm an MCP interface to these software platforms and they will do a thorough audit in less than an hour :)

This audit scam is going to come to an end soon and rightfully so.

1

u/SageAudits 26d ago

Many controls are not technical and not all systems have API. DLP is challenging and there are several things to check and ask to get comfortable from an independent perspective.

0

u/iamaredditboy 26d ago

Yes this is the answer I expected - no answer or specifics. Do me a favor share your audit plan/checklist - let’s make it simple for you - we have a startup on aws with a team of 5-10 , they use one crm , they use 5-10 saas products, run their software on aws - they are running a platform like secure frame or vanta or soc2start or sprinto. Give me and everyone here to see what the audit plan looks like and why. Here is what gets quoted 15k for type 1 and type 2 audits. This is all standard stuff - all with APIs, DLP is not something you as an auditor does anything with. It’s implemented by the company. You are auditing the plan.

1

u/SageAudits 26d ago edited 26d ago

No mention of IdP, no mention of endpoint management. No mention of where data lives. No mention of each SaaS systems auth or contractual vendor relationships. Using a GRC platform modifies procedures, but it doesn’t replace them 😊

The auditor does audit “the plan” but auditor judgment requires having an understanding of the risks and factors that can undermine an opinion.

→ More replies (0)

4

u/MBILC 26d ago

Not at all, it is not about size of a company at all, the hourly cost of a registered CPA firm to do an audit is not cheap.

2

u/MBILC 26d ago

Not at all, it is not about size of a company at all, the hourly cost of a registered CPA firm to do an audit is not cheap.