TRACK: PRICE BASICS · GUIDE 02 OF 10
Platform fee vs audit fee: two bills for one SOC 2 report
Short answer
SOC 2 usually involves two costs: the compliance platform that prepares you and the CPA firm that performs the examination and issues the report. Vendors connect the two in different ways, from partner networks to an in-house audit team, but none of the seven in our census publishes an audit fee.
By The Cost Desk, Compliance Pricing · Published 2025-07-15 · Updated 2026-09-29 · 2 min read
Buyers often ask what SOC 2 costs as if it were one purchase. It is at least two. The first is the compliance platform: software that maps controls, collects evidence, runs policies and tracks readiness. The second is the audit: an examination performed by a CPA firm, which issues the SOC 2 report your customers ask for.
Why the audit is separate
The AICPA describes SOC as "a suite of service offerings CPAs may provide", and its SOC 2 guide covers an examination of controls relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy (AICPA). The report is the auditor's opinion. A software vendor cannot issue it, so the auditor's fee sits outside the software subscription unless someone bundles it.
How the vendors in our census connect the two
- Secureframe Fundamentals lists "Access to the Secureframe Audit Partner Network".
- Sprinto Foundation lists audit management, Sprinto network auditor access and bring your own auditor (BYOA).
- Scytale describes a Built-In Audit with partner auditors, and says its compliance expert takes over management of the audit process with your chosen auditor.
- Vanta sells an Audit product and its startup page cites 26k audits completed with AICPA-peer reviewed auditors (a vendor figure).
- Drata lists auditors among its 1300+ partners.
- Thoropass is an audit and assessment company with its own automation platform, so the audit and the software come from one firm.
- Scrut offers an Internal Auditor agent; an external audit path is not described in the material we read.
"Access" to a network is not the same as a fee included in your subscription. None of the seven pricing pages publishes an audit fee.
What to ask
Ask every vendor two direct questions. First: is the audit fee in this quote, or will the audit firm bill us separately? Second: which CPA firm performs the audit, and can we choose our own? The answers decide whether two quotes are comparable at all.
Budgeting the two lines
Keep two lines in your budget until a vendor confirms in writing that one quote covers both. If a vendor bundles the audit, ask for the audit portion to be itemized so you can compare it with an audit firm's direct quote. If you bring your own auditor, check that the platform supports it: Sprinto lists BYOA on Foundation, and Scytale says it works with your chosen auditor.
The takeaway
When you compare a platform's price with another platform's price, confirm first that you are comparing platform with platform, or platform plus audit with platform plus audit. The pricing census shows each vendor's audit path in one column.
Next guide: SOC 2 Type I vs Type II: what changes in the budget