Is a cheap SOC 2 audit a real audit?

A low fee isn't the red flag

The question I get most about a cheap SOC 2 audit is simple. Is it real? Here is the honest answer from someone who sat on the audit side for years. The price alone does not tell you. I have seen inexpensive audits that did the real work, and expensive ones that were closer to a rubber stamp. The number on the invoice is not the tell. What the auditor actually did is.

So before we talk about money, give the low-cost channel its due. Compliance platforms filled a real gap. A founder used to have two bad options: pay enterprise prices to a traditional firm, or hand-collect evidence in a spreadsheet for months. Platforms organized that evidence and kept it current. That part is genuinely useful, and it is not the problem.

What actually makes an audit real

A SOC 2 is a CPA's opinion under AICPA attestation standards, and the standard fixes the work. AT-C 205 says the auditor has to plan the engagement, weigh the risks, and gather enough solid evidence to stand behind an opinion. The line that matters most is this. Inquiry is never enough. "Inquiry" just means asking. The auditor cannot ask whether a control works, write down your answer, and move on. They have to inspect it, watch it run, or redo it themselves, and document what they saw.

In plain terms, a real examination looks like this. Someone talks to you about how your systems actually run. They pull real evidence, your access logs, your change history, your actual configuration, not a screenshot and not a green checkmark on a dashboard. They sample it. They chase the exceptions. Then they write the opinion, and where it applies, a second reviewer who was not on the job checks it. Evidence the auditor gathers directly is simply more reliable than evidence handed to them, and the standards treat it that way.

That is true whether you paid three thousand dollars or thirty thousand. The procedures do not shrink because the fee did. So the real question is never "was it cheap." It is "did those procedures actually happen."

Why a real audit can cost less than it used to

Here is the part that usually gets skipped. The old assumption that a real audit had to be expensive came from a world where a human did every hour by hand. Pulling evidence, sorting it, formatting the report. That is most of the hours, and most of it is repetitive. When software handles the repetitive collection and the CPA spends their time on judgment and testing, the cost of a real audit genuinely comes down. Cheap and real stopped being opposites.

So a low fee is not a warning sign by itself. A low fee with no real procedures behind it is. Those are two different things, and the price tag cannot tell them apart.

The dynamic worth watching

If price is not the problem, what is? It is structural, and the profession is now naming it out loud, so I will state it as fact rather than opinion.

When audits get funneled through a referral channel, the firm on the other end often accepts a low fixed fee and a tight deadline to win that steady flow of clients. The AICPA's SOC working group has warned that promises of fast and easy can come at the expense of quality and objectivity. A separate Journal of Accountancy analysis names cross-referral concentration and vendor-driven deadlines as real threats to a service auditor's independence. When your client introductions depend on a tool provider, finding too many problems can strain the relationship that feeds your practice.

None of that is an accusation about any one firm. It is the shape of the incentives. A low fixed fee, plus dependence on referrals, plus a deadline someone else set, all lean the same way, toward fast, high-volume, light-touch testing. That pressure is there whether the sticker says two thousand or ten. It just bites hardest when the fee leaves no room for the hours.

How to tell, in one conversation

You do not need to audit your auditor. You just need to ask what they did, and listen for whether real evidence was ever in the room.

• Did you talk to a person about how our systems work, or did the whole thing run off the platform?
• What did you inspect directly from our environment, and did you sample it?
• When you found an exception, what happened next?
• Who reviewed the work besides the person who did it?

A real auditor answers these easily, because they lived them. If the answers are vague, or everything traces back to a dashboard's checkmarks, that is your signal. And the price had nothing to do with it.

The fee is not the story. The work is. Ask what work was done, and judge the audit on that.