Every founder I talk to about SOC 2 asks the same question first: "Should we use Drata or Vanta?"
It's the wrong question. The GRC platform matters, but it's a tool. The auditor is the one who determines whether your controls are suitably designed, whether your evidence holds up, and whether the final report is worth the paper it's printed on. A great platform with a bad auditor produces a report that falls apart under customer scrutiny. A decent platform with a rigorous, experienced auditor produces a report that builds real trust.
What a bad auditor looks like
They accept whatever evidence the platform exports without question. They don't ask follow-up questions about how controls actually operate. They produce a report that reads like a template with your company name dropped in. They finish the engagement in a suspiciously short timeframe. They have no opinion on whether your controls are actually good, just whether they technically exist.
If this sounds like the Delve model, it is. The Delve scandal was an extreme case, but the underlying dynamic exists across the industry: auditors who prioritize volume over rigor, and companies who want the certificate without the work.
What a good auditor looks like
They push back. They ask how your access review process actually works in practice, not just whether you have a policy that says you do one. They flag gaps and give you a chance to fix them before the report is finalized. They design their own test procedures rather than accepting pre-packaged evidence at face value. They produce a report that you'd be comfortable handing to a sophisticated enterprise buyer.
A good auditor makes your program better. Not just your report.
How to choose
Track record. Ask how many SOC 2 audits the firm has completed.
Timeline. Ask about their average engagement timeline. If it's less than 4 weeks for a Type II, ask why.
Test procedures. Ask whether they use their own test procedures or rely on the GRC platform's outputs.
Sample report. Ask for a sample report (redacted) so you can see the level of detail.
Peer review. Check whether the firm has AICPA peer review.
Independence. Check whether the firm has any financial relationship with your GRC platform vendor. Auditor independence isn't just an ethical principle — it's a structural requirement of the attestation. If your auditor gets paid by your platform for referrals, that's a conflict worth understanding.
The bottom line
Pick your auditor with the same care you'd pick a lawyer or a CPA. Then pick your platform. Not the other way around.
Up next in the series
In Post 2, we look at security questionnaires: why the companies that treat them as a sales asset close deals faster than the ones that treat them as a compliance burden.
Read Post 2 →