The client asked us to find their auditor. It is a common request and it is worth explaining why the answer is not simply the cheapest quote.
The introduction is part of the work
We shortlisted four firms and ran the same package past each of them. The one we landed on is both a licensed CPA firm and an accredited certification body, so a single organisation performs the SOC 2 attestation and the ISO 27001 certification. That is one engagement letter, one evidence request process, one set of scheduling constraints and one relationship to manage instead of two running in parallel. They were engaged while remediation was still under way, with a weekly cadence set from the start.
The logistics saving is larger than it sounds. Two separate assessors means two sampling approaches, two views on what evidence is sufficient, and two calendars to reconcile against a single remediation plan. Where the same firm covers both, the overlap between the standards gets assessed once rather than argued twice, and the parts of your programme that serve both frameworks only have to satisfy one interpretation.
That timing is deliberate, and it is covered in more detail in the dual-framework case study. The short version is that scope, sampling and what counts as sufficient evidence are all things you discuss with an auditor rather than receive from one. A team that first speaks to its auditor when it believes it is ready has given that conversation away, and generally finds out during fieldwork that an artefact it spent three weeks producing is not the artefact that was wanted.
There is a structural reason this matters more than people expect, and it is worth stating plainly because it shapes everything else here.
Your auditor is not allowed to help you
An audit firm has to remain independent of what it assesses. That means it cannot design your controls, write your policies, build your evidence register or tell you how to fix a gap in any detail that amounts to doing the work. If it did, it would be auditing its own output, and the opinion would be worth nothing.
Companies routinely misread this as unhelpfulness. It is not. It is the constraint that makes the report mean something.
The practical consequence is that there is a gap between "your control will not pass" and "here is a control that will", and somebody has to stand in it. Either you do, with whatever internal capacity you have, or you bring in a firm that is not issuing the opinion and therefore has no independence constraint. That is the role we occupy, and it is why the prep firm and the audit firm are two different organisations rather than an upsell.
What we are actually checking when we vet a firm
Price is one input and rarely the deciding one.
Sector familiarity. An auditor who has done a dozen infrastructure or health engagements asks better questions and wastes less of your time on ones that do not apply. An auditor learning your sector at your expense is a slower audit, and slower is more expensive regardless of the rate.
How they handle evidence. Some firms accept a well-organised register and sample from it. Others insist on their own portal and their own naming convention, which means somebody on your side re-files everything. That cost is real and it never appears in the quote.
Responsiveness. The gap between a question and an answer sets the pace of the entire engagement. A firm that takes a week to come back adds weeks to the timeline whatever the proposal says about duration. This is the single most reliable predictor of whether an audit finishes when it was supposed to.
Willingness to talk before fieldwork. Firms differ on this more than on anything else. Some will discuss scope and sampling openly during preparation, staying comfortably inside their independence obligations. Others treat any question as a request for an opinion they cannot give. The first kind produces a far better outcome for a first-time candidate.
Whether they will say no. An auditor who agrees to everything is not being helpful. You want the one who says a control as designed will not survive sampling, while there is still time to change it.
Capacity and timing. Audit firms have busy periods, and a firm that is at capacity will still take the work and then schedule fieldwork months out. Ask when they can actually start, not whether they can take you.
Licensing and peer review. For a SOC 2, the firm must be a licensed CPA firm and should be able to show a current peer review. For ISO, the certification body should be accredited by a recognised accreditation body. Both are quick to check and occasionally surprising.
Why a prepared package changes the price
Audit fees are driven substantially by hours, and hours are driven by how much work the firm has to do to get what it needs.
An auditor arriving to a defined scope, a written system description, a populated evidence register and named control owners is doing a different job to one arriving at a company that has not started. The second engagement involves chasing artefacts, explaining what is needed, re-requesting things that came back in the wrong form, and repeating that loop across dozens of controls. All of it is billable.
Firms that price on effort reflect this, and in our experience they will discuss it openly when readiness is demonstrable rather than promised. It is not a discount in the coupon sense. It is a smaller number because there is genuinely less work in it, and a firm quoting honestly will say so.
On this engagement that came to $11,000 off a five-figure quote, across both frameworks. Not negotiated down, and not a gesture. The firm revised its number once we had set out the client's readiness position and confirmed that a prep firm was running the programme.
The mechanism is worth understanding, because it is repeatable rather than lucky. An auditor pricing an unprepared company is estimating a long tail of unknowns: how many artefacts will come back in the wrong form, how many rounds of clarification each control will take, how much of the system description they will end up writing questions about. That uncertainty has to be priced, and it gets priced conservatively, because the firm carries the risk if the estimate is wrong.
Take the uncertainty away and the estimate changes. When the evidence register exists, the control owners are named, the scope is written down and somebody on the client side speaks the auditor's language, the firm can price the work it can actually see. Many are glad to pass that back, because a smooth engagement is worth more to them than a padded one: it finishes on schedule, it does not consume partner time on chasing, and it is the kind of client they want again next year.
Set against the cost of the preparation itself, that single line covered a meaningful share of it before counting anything else the programme produced.
The corollary matters more. A company that goes to audit unprepared frequently pays more than the original quote, because the effort was underestimated when it was priced. Scope creep on an audit is not the firm being opportunistic. It is the estimate meeting reality.
The questions worth asking before you sign
Five that reliably separate firms:
What is your sampling approach for a period of this length, and how many instances will you want per control? How do you want evidence delivered, and will you accept our register? Who is actually on the engagement, and are they the people in this meeting? When can fieldwork start, not when can you take us? What have you seen go wrong most often with companies our size?
The last one is the most revealing. A firm with a good answer has been paying attention across their book. A firm without one has not.
What the client got out of it
Two firms engaged early, both aware of the scope before fieldwork, both working from an evidence register whose shape they had already seen. The timeline was set with their input rather than against their availability, which is the difference between a date you chose and a date you were given.
If you are at the point of choosing, our cost breakdowns covers what the work runs to, why quotes differ covers why quotes for the same scope differ so much, and auditor management and advocacy covers what we do when we sit between you and the firm.
Note. The client is unnamed. Figures are described by what drives them rather than quoted, because audit pricing is specific to scope and we will not publish another firm's numbers.
What we charge for this. The figures above are market ranges. Our own fixed-scope prices are on the pricing page, alongside every cost breakdown we have written.