PW-SOC2-006 SOC 2 readiness spoke
Auditor engagement letter before the report
TL;DR. The engagement letter locks scope, Trust Services Criteria, period, fees, and responsibilities before fieldwork. Some procurement teams accept a signed engagement letter plus roadmap as interim proof you are not vaporware—until the report lands.
What the engagement letter is
It is the contract with your CPA firm for the SOC 2 examination: scope, period or as-of date, Trust Services Criteria, deliverables, fees, management responsibilities, and independence terms.
What to clarify before signing
- Exact system boundaries and locations.
- Categories in scope (and change-order process if buyers demand more).
- PBC turnaround expectations both ways.
- Draft review cycles and report delivery format.
- Whether readiness consulting is separate (independence matters).
Using it with procurement
Some security questionnaires accept a redacted engagement letter plus roadmap as interim assurance. Offer it when asked; do not wave it as a substitute for operating controls.
Questions founders ask
Is an engagement letter the same as a report?
No. It proves you hired an examiner for defined scope.
Can the same firm implement and audit?
Independence rules matter—keep advisory and examination appropriately separated.
What fee surprises happen?
Scope changes, extra locations, and slow PBC cycles.
Sources
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- primary System and Organization Controls: SOC Suite of Services — AICPA & CIMA — SOC suite overview; links TSC download and related description criteria.