Spend enough time on LinkedIn and you will see a familiar argument.
An auditor warns that SOC 2 automation platforms are turning serious examinations into a race for the cheapest report. A software company replies that the old way is slow, expensive, and full of work a machine could have done.
Meanwhile, a business trying to get its first SOC 2 report sees a $25,000 or $50,000 audit proposal in one tab and a $2,000 to $12,000 "SOC 2 automation" offer in another. Naturally, it begs the question: is somebody taking advantage of us?
It is a fair question. I work with companies doing the actual work behind these reports, and I think both sides of this argument leave out something important.
01 We are comparing two different jobs
A GRC platform such as Drata or Vanta can organize your controls, connect to systems, collect evidence, run automated checks, and give your team and auditor a shared place to work. That can save a tremendous amount of manual effort.
An independent CPA firm performs the SOC 2 examination and issues the report. Its job includes deciding what to examine, obtaining appropriate evidence, testing controls, evaluating exceptions, and forming an opinion.
Your company has a job too: operate the controls and take responsibility for the system being described. A green status indicator does not perform an access review, resolve an exception, or make a policy true in practice.
So "platform or auditor?" starts as the wrong purchase question. Most companies need to understand how the platform, the auditor, and their own people will work together.
02 Where the auditors have a point
A platform can tell you that an integration is connected and a test is passing. It may not know whether you connected every relevant system, whether the test covers the actual risk, or why an exception occurred.
Suppose the tool shows that every employee completed security training. Lovely. Did it capture the contractors who handle customer data? Did the training happen during the period being examined? Was the correct version assigned?
Those questions require someone to understand the business and challenge the evidence. An auditor should be able to ask them without a platform provider setting the scope, dictating the deadline, or limiting access to the records.
The AICPA has warned about exactly those kinds of pressures in auditor relationships with SOC 2 tool providers. That concern is real. We should not pretend an automated evidence pipeline has somehow become an independent professional opinion.
03 Where the auditors lose me
The existence of that professional judgment does not mean every hour of the old process must remain billable forever.
A premium fee and a famous name do not prove the work was done well, either. In its 2024 inspection of KPMG, the PCAOB found significant evidence deficiencies in 13 of the 64 issuer audits it reviewed. Those were public-company financial and internal-control audits, not SOC 2 examinations. The point is narrower but important: even a major firm must be judged by the quality of the work it actually performs.
If a platform consistently collects records, tracks changes, organizes control owners, and gives the auditor direct access to evidence, some of the work that once took days of emails and screenshots should take less time. AI may help identify gaps and unusual results for a person to investigate. Auditors themselves can use better technology to cover more ground.
I am not saying every $50,000 audit is overpriced. Scope, complexity, the number of systems, the reporting period, and the quality of the company's records all matter. I am saying neither the size of the invoice nor "this is what we have always charged" is an explanation of quality or value.
If technology removes hours of administrative work, customers have a reasonable basis to ask how that efficiency affects the fee. Charge for the work and judgment the examination actually requires. Explain what is in the price.
04 Where the automation pitch loses me
A low price does not prove the audit is weak, just as a high price does not prove it is strong. But what does the advertised price buy? Software? Readiness support? A Type I examination? A Type II examination? The independent auditor's fee? What happens if the auditor asks for more testing or finds a problem?
These details matter because the tool can make evidence easier to gather, but it cannot decide in advance that every company will have a clean report. Some controls are manual. Some integrations miss part of the story. Some findings deserve an uncomfortable conversation.
The public dispute involving Delve brought this concern into sharper focus. Delve disputes the allegations about its service. In its own response, it said it was halting automation that interacts with audit workflows, rebuilding its auditor network, and offering re-audits to active customers. Whatever you conclude about the dispute, those announced steps show how consequential the boundary between platform activity and auditor judgment can be.
If a sales pitch makes that boundary hard to see, ask more questions before signing.
05 The answer is in the division of labor
Here is the version I would like to see more often.
The company owns the security program, performs the controls, and explains what actually happens.
The platform automates repeatable collection and monitoring, makes gaps visible, and keeps the work organized.
The independent auditor decides the examination approach, tests the evidence, investigates exceptions, and issues the report.
Each party gets the benefit of technology. Each remains accountable for its own work.
This should change the price conversation, but it should also improve the quality conversation. A firm charging a premium should be able to explain the scope and judgment behind it. A low-cost package should make clear who the auditor is, what is included, and what happens when the standard workflow does not fit your company.
06 Questions worth asking before you buy
Whether you start with an auditor, a platform, or both, I would ask who the independent CPA firm issuing the report is and whether you can speak with them directly. I would ask what exactly is included in the quoted price and what costs extra, which evidence is collected automatically, and who checks whether it is complete and reliable.
I would also ask who sets the scope, testing approach, timeline, and final conclusions, what happens when the auditor finds a control failure or needs evidence outside the platform, and who will run the program between audits, after the implementation team leaves.
The answers tell you far more than a green dashboard or an impressive hourly rate.
07 So who is right?
Auditors are right that an independent examination takes human judgment. Automation providers are right that much of the work surrounding it can be faster, more consistent, and less expensive.
Neither gets a free pass. An auditor should not use independence, a famous firm name, or a high fee as a substitute for showing the quality of its work. A platform should not sell speed as though it eliminates judgment, testing, or your responsibility to operate the controls.
The question is not how quickly you can buy a SOC 2 report. It is whether the process gives your customers a credible reason to trust what the report says.
08 Sources for the facts
AICPA, SOC 2 examination guide.
AICPA Professional Ethics Division, SOC engagements and tool providers.
Delve, public response on audit workflow changes.
PCAOB, 2024 inspection report on KPMG.
Related reading: explore AskDegree solutions when you want the platform, the auditor, and the program work coordinated end to end, or use the Security Questionnaire Response Plan when a customer review is due before the report is.
