Switching SOC 2 audit firms without paying for the same months twice

In a financial statement audit, the professional standards spell out how the old firm and the new firm talk to each other when a client moves. SOC 2 works differently. It is an attestation engagement over a stated period,¹ and the real limit is the calendar, not the paperwork.

What a switch actually costs a small team

The fee of the new firm is only one line. The bigger cost is time you already paid for and cannot reuse. If you leave a firm halfway through a period, the months it watched do not travel with you, so you pay again to keep your program running while a new window builds up.

On our software, one restarted 3-month observation window held on the monthly plan comes to $597. That is the floor, since a real restart can run longer. The cost you cannot see on an invoice is worse: a buyer waiting three extra months for a report you thought was nearly done. Switch in the gap between periods and both costs mostly disappear.

The low cost moment is the gap between reports

When a period ends and the report is issued, you stand in a gap with no open engagement. That is the best time on the calendar to change firms. Nothing is half tested and no samples are half pulled. The new firm opens a fresh period on its first day, and the old firm’s work is already wrapped up in a report you hold.

Send your last report to the new firm early. It will not rely on the conclusions, but the report shows what was in scope, what the old firm flagged, and how your controls looked a year ago. Nothing else shortens the scoping call as much, and it brings disagreements up while they are still easy to settle. Before you pick a date, read how long a SOC 2 report stays valid, because your current report’s age sets how much slack you have.

Why a mid period move restarts the clock

A Type 2 opinion covers a stated period, and the firm signing it must have observed that period.² You cannot inherit observation. No engagement letter and no transition plan changes that.

Sometimes the new firm can test the earlier months itself, from your own records rather than from the old firm’s file. That depends on what your systems still hold. So do not ask whether it will honor the period you planned. Ask for the earliest start date it will sign for, and get the answer in writing.

That leaves two options, and neither one is a handover. The new firm can open a shorter period from the day it takes over, which gets you a report sooner with less history behind it. Or it can wait for your next period and cover it in full, which leaves a stretch of calendar that no report describes.

If the current engagement is going badly, a short honest period still beats a long one you cannot defend. How the observation period works explains the floor on a restarted window before you promise a date to a customer.

What moves with you and what stays behind

Switching gets confusing when the engagement is treated as one package that changes hands. It is really three things. Some of it is yours, some belongs to the firm you are leaving, and one part belongs to nobody and simply runs out.

The workpapers question deserves one more sentence. A firm’s record of what it tested, how it sampled and why it concluded what it did belongs to that firm, and a new firm would not want it anyway, because leaning on it would weaken the independence of its own view.³ Your report also carries a restricted use paragraph naming who may receive it, so read it before you forward it.²

Export everything before you give notice. Portal access is a courtesy that ends with the engagement, and a year of screenshots is much easier to download once than to rebuild.

What the new firm will do again

Assume nothing carries across. The new firm builds its own basis for an opinion, and the steps below are the ones you can prepare for. Preparing for them is what keeps the first engagement short, and a short engagement costs less.

1. Scope. It confirms which trust services criteria are in scope⁴ and which systems sit inside the boundary. Scope that shifts between firms is where surprises hide.
2. Control design. It forms its own view of whether your controls meet the criteria. A clean opinion last year is useful context, nothing more.
3. Samples. It pulls its own samples across the period it watched. The old samples support the old opinion only.
4. Past findings. Anything the old firm recorded as a deviation gets a fresh look. How exceptions work shows what that looks like in a report.
5. Who signs. The firm has to be eligible to sign the opinion. Who can perform a SOC 2 audit is worth checking before you engage anyone.

A switching plan in five steps

The order matters more than the speed. Each step sits where it does because doing it later costs you something you cannot easily get back, whether that is access, evidence or time.

1. Export first. Evidence, policies, the issued report and any request history, while you can still log in.
2. Finish the current period if you can. A finished period is an asset. A dropped one is worth nothing.
3. Get the new start date in writing. That date, not the signature, is what your customers are really buying.
4. Tell buyers before they ask. A short note about the new window lands far better than a gap they find.
5. Keep sharing the old report until the new one arrives. It stays useful until something replaces it.

Fix the controls, then decide whether to move

A new firm does not reset your posture or erase what the last report said. It changes who looks at you and when. Weak controls will be found again, just by fresher eyes. Fix them first. Then move.

Through cybersoftware there is no separate auditor contract to unwind. The software runs at $199 a month, cancel any time. Audits go through our preferred pricing program, and we negotiate the fee on your behalf, inside the app, and a Type 2 is arranged once the 3-month observation window is complete. Scope is fixed to Security, so there is nothing to renegotiate there either. The SOC 2 timeline shows how those dates fall.

Not sure your controls are ready for a fresh set of eyes? The free readiness assessment takes about 15 minutes and costs nothing. Run the free assessment, or see the plans if you already know what you need.