Ask three audit firms what a SOC 2 costs and you will get three numbers and the same caveat: it depends. That answer is accurate and not much use. What it depends on is a short list of decisions, most of which you make before any firm sees your environment.
This article sets out those decisions. It covers what an audit fee is actually paying for, the scope choices that move it, the evidence habits that inflate it, and the internal cost that never appears on an invoice. It does not quote prices. They vary by firm, by market, and by year, and any figure here would be out of date or wrong for your situation.
What the audit fee pays for
An audit fee is mostly auditor hours. The firm estimates how long it will take to understand your system, test your controls, review the evidence, write the report, and put it through its own quality review. Almost every cost driver below works by changing one of those hours.
That framing helps when you read a proposal. If a choice adds systems to understand, controls to test, or samples to pull, it adds cost. If a choice makes evidence quicker to evaluate, it removes cost, even when it does not change your scope at all.
Scope decisions that move the fee
Report type and period
A Type I report tests design at a point in time. A Type II tests whether controls operated over a period, which means the auditor samples across months of activity. Type II involves more testing, so it costs more. A longer observation period usually means larger populations to sample from, which can add testing too.
Some companies start with a Type I and move to a Type II. That is two engagements rather than one, though the first makes the second easier. Whether it makes sense depends on what your buyers need now. SOC 2 Type I vs Type II covers that choice.
Categories
Security is required. Availability, processing integrity, confidentiality, and privacy are optional, and each adds criteria, controls, and testing. Privacy tends to add the most, because its criteria cover notice, consent, collection, use, retention, disclosure, and data subject access. Add a category because your customers' commitments call for it, not because it reads well on a sales deck.
System boundaries
The system in scope is the product or service your report describes. Every additional product, environment, region, or office inside that boundary is more for the auditor to understand and sample. A tight boundary drawn around the service your customers actually buy is cheaper and easier to defend than one that sweeps in internal tools with no customer data. How to draw it is the subject of scoping your first SOC 2 report.
Subservice organizations
Your cloud provider, and any other vendor that runs part of your system, is usually a subservice organization. Most reports use the carve-out method: the vendor's controls are excluded, and you show that you monitor the vendor, typically by reviewing its own SOC report. The inclusive method brings the vendor's controls into your report and requires the vendor's cooperation, which adds testing and coordination. Carve-out vs inclusive explains the difference.
Evidence habits that inflate the fee
This is the driver teams underestimate. Two companies with identical scope can take very different amounts of auditor time, because one produces evidence the auditor can evaluate once and the other does not.
Screenshots instead of exports. A screenshot shows a moment and often omits the timestamp, the system, or the filter used. Auditors may ask follow up questions, or ask to observe the screen live. A system-generated export with its query and date answers those questions up front. The trade-offs are set out in screenshots vs system-generated evidence.
Incomplete populations. Sampling starts from a full list: every change, every new hire, every leaver. If the list is assembled by hand, the auditor has to test whether it is complete before sampling from it.
Rolling re-requests. Each round of "that is not quite what we asked for" costs hours on both sides. Agreeing what each piece of evidence should look like before fieldwork reduces those rounds.
Exceptions. A failed sample can lead the auditor to expand testing, and every exception needs to be documented and described in the report.
None of these change your scope. All of them change how long the audit takes.
The internal cost nobody invoices
The fee is often the smaller part of the total. The larger part is your team's time, and it falls in three places.
Getting ready. Writing policies, closing control gaps, configuring systems, and deciding who owns what. For a first audit, this is usually the bulk of the effort.
Operating the controls. Access reviews, risk assessments, vendor reviews, and training happen whether or not an auditor is watching. The audit only tests that they did.
Supporting fieldwork. Answering requests, attending walkthroughs, and pulling samples. This lands on engineering leads at the same time as their regular work.
There are also costs adjacent to the audit. Many buyers expect a penetration test, though the trust services criteria do not name one. Some teams buy tooling, readiness help, or both. These are choices, not requirements, and they should be weighed against the internal hours they save.
How to compare quotes fairly
Firms price differently, so two quotes are only comparable if they describe the same engagement. Before comparing, check that each quote states:
The report type and, for a Type II, the period dates
The categories in scope
The system and any additional locations or environments
How subservice organizations are treated
What triggers additional fees, such as scope changes or delays you cause
Whether a readiness assessment is included, and if so, who performs it
A low quote that assumes a smaller scope, or excludes things you need, is not cheaper. It is a different engagement. Price is also not the only basis for the decision. How to choose a SOC 2 audit firm covers licensing, independence, and the team who does the work.
Where you can realistically reduce cost
Some levers are real. Others look like savings and are not.
Real levers:
Keep the system boundary to the service customers buy.
Add optional categories only when a commitment requires them.
Collect evidence as controls run, from source systems, with dates.
Fix gaps before the observation period starts, not during it.
Write policies at frequencies you can meet. A quarterly review you miss is an exception. A semiannual one you meet is not.
False economies:
Starting the period before controls work, to get the report sooner. The exceptions stay in the report.
Choosing a firm on price without checking standing or independence. A report that a buyer questions costs more in delayed deals than the difference in fees.
Cutting the readiness step. It is usually cheaper to find a gap yourself than to have an auditor find it.
How TrustLynce helps
TrustLynce collects evidence on a schedule from cloud, identity, HR, and code systems, timestamped and attributed, so populations and samples come from source systems. The readiness dashboard shows gaps per framework before your period starts, which is when they are cheapest to close.