SOC 2 Letter of Engagement: What to Negotiate

What Is the Engagement Letter?

The engagement letter (or "letter of engagement") is the contract between your company and the CPA firm performing your SOC 2 audit. It defines the scope, timing, fees, responsibilities of both parties, and the conditions under which the engagement proceeds.

For Type I, the engagement letter is typically signed weeks before the audit date. For Type II, it is signed before the observation period begins (or as soon as possible after the observation period start if you engage the auditor mid-period).

Key Terms to Review

Scope: precisely which Trust Services Criteria are included (Security only? Security and Availability?). Which services and systems are in scope. Subservice organisations and carve-out/inclusive method.

Observation period (Type II): start date and end date. These define the time window for which controls are tested. Getting this right is important — you cannot easily change the period after signing.

As-of date (Type I): the specific date as of which controls are evaluated.

Report type: confirm the letter specifies Type I or Type II (and that Type II for an initial engagement or Type II renewal is clear).

Scope and Period

Negotiating scope: for a first engagement, start with Security criterion only. Expanding scope (adding Availability, Confidentiality) mid-engagement or at signing without adequate preparation time can increase audit fees and extend fieldwork.

Observation period start date: the start date should be after your controls are fully operational. Starting before controls are implemented means the auditor will find an operating gap in the early portion of the period. A 6-month observation period that starts when everything is ready is more defensible than a 12-month period that starts before readiness.

Period length: 6 months is the minimum for a credible first Type II report. 12 months is required by some enterprise buyers. Discuss with your auditor whether your readiness timeline allows for a 6-month initial period.

Fee Structure and Overruns

Understand the fee structure: is it fixed fee or time-and-materials? Fixed fee provides cost certainty but may come with scope limitations. Time-and-materials provides flexibility but creates cost uncertainty.

What triggers additional fees: out-of-scope work (expanding scope mid-engagement), excessive PBC response delays (requiring auditor time on follow-up), significant system changes discovered during fieldwork, or repeated requests for already-provided evidence.

Travel costs: for remote audits, no travel costs. For on-site audits, travel expenses are typically billed separately. Clarify whether fieldwork is remote, on-site, or hybrid and how travel is handled.

Pre-Engagement Obligations

Most engagement letters specify what you must provide before fieldwork begins: a completed system description draft, a control matrix, key policy documents, and access to relevant systems for automated testing.

Review these obligations carefully. If the letter requires a completed system description by Week 4 and you have not started it, that is a scheduling risk. Build the pre-engagement obligations into your programme timeline.

Some letters require that you certify certain conditions (e.g. "all material gaps identified in preparation have been addressed") before fieldwork begins. Understand what these certifications require so you are not surprised.

Report Delivery Terms

Report delivery timeline: when does the auditor commit to delivering the draft report after fieldwork completion? Typical: 3–6 weeks post-fieldwork. For time-sensitive deals, negotiate a faster delivery commitment if possible.

Draft review period: how long do you have to review the draft report before it is finalised? Typical: 5–7 business days. Ensure this is enough time for your executive team to review and approve the management responses.

Report modifications: understand the process for requesting changes to the draft report. Minor corrections (factual errors in the system description) are typically accommodated. Requesting changes to the auditor's opinion or testing results is not appropriate.

Negotiation Tips

Get competitive quotes: 2–3 quotes from reputable firms gives you pricing context and negotiating leverage. Price differences between comparable firms can be 30–50% for the same scope.

Negotiate the observation period start date carefully. Starting too early (before controls are ready) costs more in the long run than starting later with a properly prepared environment.

Ask about renewal pricing: what will the annual renewal cost relative to the initial engagement? Firms that quote a high initial fee with steep renewal discounts may be more economical over a 3-year horizon than those with flat fees.

Understand what the firm specialises in. A Big 4 firm may have brand recognition but charges 2–3x a boutique SOC 2 specialist. Boutique specialists who work exclusively with SaaS companies often deliver faster, more focused audits.