Skip to main content

Audit Firms

You will need to select an audit firm to perform an audit for your desired compliance framework. Depending on the scope of your needs, you'll want to consider various criteria when choosing an audit partner.

Choosing the Auditing Firm​

When looking for an auditor, it's important to pick a firm with a proven track record of successful attestations. We recommend interviewing at least three different auditing firms so you have a basis for comparison.

Firm Size​

Depending on the size of your organization, we recommend starting your search locally. Many times a local auditing firm can provide the same, if not better, results than large firms that have many clients.

Personality types​

You as a lead implementer or consultant for the organization will be working hand in hand with the auditing team. During the selection phase it's important to get to know their personalities. Ask yourself whether you can envision working with this auditor in a continuous audit engagement.

Previous attestations​

Prior to selection, we recommend reviewing your auditors' work from previous engagements. Ask them about controls they have found not suitably designed. For example, you could ask the auditor(s) the following questions.

  • How did you report on a control that you found not suitably designed and not operating effectively?
  • Did you assist the client with recommendations regarding how to fix the control?
  • What is the most common occurrence you see during the audit engagement that clients fail to understand?
  • Can you provide a list of contacts so we can make a reference check?
  • What is your sampling methodology, and is it in line with best practice?
  • How many System and Organization Controls 2 (SOC 2) attestations has the audit manager for this engagement performed?

Scope and Process Questions​

Beyond a firm's past work, ask questions that surface how the engagement itself will run and how much work lands on your side:

  • Which Trust Services Criteria would you recommend for a company like ours, and should we start with a Type 1 or a Type 2?
  • Who writes the system description, and what will we need to produce beyond control evidence?
  • What does the process look like from planning through report delivery, and how long does it typically take?
  • How much communication should we expect while fieldwork is underway?
  • What is the shortest Type 2 audit period you are willing to perform?
  • If you identify an exception, how will we find out, and will we have a chance to discuss the results before the final report is issued?
  • How would you audit our specific technology stack, for example which controls matter most for our object storage or container orchestration platform?

Finally, ask how the firm treats annual controls performed before the audit period opens. A penetration test or security awareness training completed shortly before a Type 2 period begins may not count as evidence within the period, so clarify whether the firm expects you to re-perform those activities, how the report will be worded if you do not, and whether the answer changes if a Type 1 preceded the Type 2. Settling this up front avoids surprise exceptions late in the engagement.

ISO 27001 Certification Bodies​

For ISO 27001 you hire a certification body rather than a Certified Public Accountant (CPA) firm, and the evaluation questions shift accordingly. The single most important check is accreditation: ask who their accreditation body is, and confirm it is a recognized national body such as the ANSI National Accreditation Board (ANAB) or the United Kingdom Accreditation Service (UKAS). A certificate issued by an unaccredited body carries little weight with the customers who asked for it. Beyond accreditation, we recommend asking:

  • For a company like ours, which Annex A controls do you expect to be out of scope or not applicable?
  • What does the process look like end to end, from planning through report and certificate delivery, and how long does it typically take?
  • How much time typically elapses between the Stage 1 and Stage 2 audits?
  • Will any part of the audit be conducted on site, and do you visit every office location in scope?
  • How and when will you communicate nonconformities, and will we have a chance to discuss findings before the final report and certificate are issued?
  • How much evidence do you expect us to gather manually versus produce from our compliance tooling?

We also recommend asking pointed questions about your actual technology stack, for example which controls they consider most important for the specific cloud services or orchestration platforms you run. The answers are a fast way to gauge whether the audit team has real technical depth or will be learning your environment on your time.

Communication Style​

Communication style is important. Everyone communicates differently, and when running point on a SOC 2 project for an organization, it's imperative that the communication barrier is broken down. You as a lead implementer for the organization will need to communicate with the organization as well as the auditors.

You will need to translate the requirements to the business and then help communicate those findings back to the auditors, making sure to frame each conversation from the audience's perspective.