---
title: "SOC 2 cost in the UK: what 25–250 person firms pay"
canonical: https://www.grcmana.io/vault/soc-2/audit-cost
published: 2024-07-03
updated: 2026-10-23
author: "Harry West"
framework: "SOC 2"
control: "Guide SOC 2 cost in the UK: what 25–250 person firms pay"
journeyStage: readiness
---

# SOC 2 cost in the UK: what 25–250 person firms pay

## Key takeaways

SOC 2 cost has no published price list: a first report is built from readiness and remediation, the CPA firm's fee, tooling and internal time. Scope, readiness and the report type with its observation window move the total most. An existing ISO 27001 ISMS shrinks readiness and internal time, but the examination fee remains.

- **Who issues it** — A SOC 2 report must come from a licensed CPA performing an examination under AICPA attestation standards. Most compliance tool providers are not CPA firms, so they cannot attest.
- **Scope drives the fee** — A SOC 2 engagement can cover one to all five trust services categories, so the size of the examination, and the CPA firm's fee, follows the scope you choose.
- **Pricing internal time** — ONS data put median hourly earnings for UK full-time employees at £19.67 in April 2025, so every 100 hours of internal time is about £1,967 before employer costs.
- **ISO 27001 reuse** — The AICPA publishes a mapping between ISO 27001 and the 2017 trust services criteria, showing where an existing ISMS already supplies the controls and evidence a SOC 2 examination tests.

Your US prospect's security team wants a SOC 2 report before the contract moves, and your board wants a number before it signs anything off. Most SOC 2 cost guides quote US dollars for a US startup. This guide is for founders, finance leads and security leads at UK B2B tech firms with 25 to 250 staff.

It breaks SOC 2 cost into the lines that make it up, shows what moves each one, and gives you a budget you can defend line by line. For what SOC 2 covers and why buyers ask for it, start with our [SOC 2 overview](https://www.grcmana.io/vault/soc-2).

## How much does SOC 2 cost for a UK firm?

SOC 2 cost has no published price list, because no two examinations are the same size. A first report is built from four lines: readiness and remediation, the CPA firm's fee, tooling and your own team's time. Three factors move the total most: scope, how ready you are before fieldwork, and the report type with its observation window.

The AICPA says as much itself. In a [Journal of Accountancy podcast on quick-turn SOC engagements](https://www.journalofaccountancy.com/podcast/2026/apr/the-risks-of-quick%E2%80%91turn-soc-engagements-and-what-cpas-should-know/), its vice president for assurance and advisory innovation explains that a SOC 2 engagement can cover one to all five trust services categories, and can be complex or relatively simple depending on the business.

That is why a single headline figure is misleading. A 40-person SaaS firm reporting on Security alone and a 200-person platform reporting on four categories across two hosting regions are buying different examinations.

Searchers often call this "SOC 2 certification cost". The report is an attestation by a licensed CPA firm, not a certificate, but the budget questions are the same.

## What are the four SOC 2 cost lines?

The four SOC 2 cost lines are readiness and remediation, the CPA firm's examination fee, tooling, and internal time. Only the fee arrives as a quote. The other three depend on how much security practice you already run, how much help you buy in, and whether evidence comes from your systems or from people.

Budget each line separately. They behave differently between a first Type 1 report, a first Type 2 report and the years after.

| Cost line | What it pays for | What drives it | Type 1 | Type 2 |
| --- | --- | --- | --- | --- |
| Readiness and remediation | Scoping, a gap assessment, then building or fixing the controls the gaps expose | How many controls are missing, not just undocumented | One-off, front-loaded | The same work, plus controls that must run consistently before the window opens |
| CPA firm's fee | The examination, the testing and the report | Categories, systems, locations, subservice organisations, period length | Design at a point in time | Design plus operating effectiveness across a period, so more testing |
| Tooling | Policy management, evidence collection, monitoring | Number of systems and integrations | Often optional for a narrow scope | Earns its place when evidence must be produced every month |
| Internal time | Control owners running controls, gathering evidence, answering the auditor | Maturity of existing practice and of your evidence trail | Concentrated in the weeks before the report date | Spread across the whole observation window |

Readiness is where budgets diverge most. A firm that already runs single sign-on, managed devices, code review and tested backups mostly needs to evidence its controls. A firm without them has to build the controls first, and that is an engineering cost before it is a compliance cost.

Tooling is worth its subscription only when it removes recurring work. A platform that stores policies while someone still screenshots evidence each month adds a cost without removing the hours.

Internal time is the line nobody invoices, so it is the line nobody budgets.

## How does a CPA firm build a SOC 2 audit fee?

A CPA firm builds a SOC 2 audit fee from the size of the examination: the trust services categories in scope, the systems and locations that deliver the service, the subservice organisations involved, and the length of the observation period for Type 2. More scope means more controls to test and more evidence to sample.

The fee drivers to check before you ask for quotes:

- **Trust services categories.** Each category you add brings its own criteria and controls to test. Add one only when a customer contract needs it.
- **Systems in scope.** Every application, database and infrastructure layer that delivers the service has to be described and tested.
- **Locations and entities.** More offices, hosting regions or legal entities inside the boundary mean more to understand and sample.
- **Subservice organisations.** Your cloud host and other critical suppliers either sit outside the report or are tested within it, and the choice changes the work.
- **Report type and period.** A [Journal of Accountancy article on SOC 2 reporting](https://www.journalofaccountancy.com/issues/2011/jul/20103500/) advises the auditor to consider whether the report period is long enough to form an opinion on whether the controls operated effectively. Choosing between report types has its own guide: [SOC 2 Type 1 vs Type 2](https://www.grcmana.io/vault/soc-2/type-1-vs-type-2).

Who signs the report also matters. The AICPA's podcast explains that these engagements must be performed by licensed CPAs under US state law, so whoever you buy from, the report must come from a licensed CPA practice. Ask every UK firm that quotes which licensed practice will sign.

Most of these drivers are settled before you request a single quote, by how tightly you scope and how ready you are when fieldwork starts.

Scope is a pricing decision disguised as a technical one.

## How do you cost internal time for a SOC 2 report?

Cost internal time for a SOC 2 report by naming the people involved, estimating their hours for each activity, and multiplying by what those hours cost you. Use your own salary data where you can. As a reference point, the ONS puts median hourly earnings for UK full-time employees at £19.67 in April 2025.

The [ONS Annual Survey of Hours and Earnings](https://www.ons.gov.uk/employmentandlabourmarket/peopleinwork/earningsandworkinghours/bulletins/annualsurveyofhoursandearnings/latest) gives that figure excluding overtime, and its 2025 estimates are provisional. It is a national median across all occupations, so treat it as a floor for pricing engineers and security leads, not a substitute for your payroll.

At that median, every 100 hours of internal time is about £1,967 in pay before employer costs. The calculation is simple; the hours are what you have to estimate honestly.

List the activities, then put a named owner and an hour estimate against each:

1. **Scoping** the system, the categories and the subservice organisations.
2. **Writing and approving policies** that match how the business actually works.
3. **Fixing gaps** the readiness assessment finds, usually engineering and IT time.
4. **Running controls** such as access reviews, change approvals and vendor reviews on their stated cadence.
5. **Preparing the system description** that management asserts to.
6. **Supporting fieldwork**: walkthroughs, evidence requests and follow-up questions.
7. **Responding to exceptions** and reviewing the draft report.

For a Type 2 report, activities 4 and 6 repeat across the observation window. Price them per month, not once.

## What does SOC 2 cost in year two and beyond?

SOC 2 cost in year two is mostly recurring: a fresh examination for the next period, tooling renewals and the internal time to keep controls running. One-off readiness and remediation largely fall away. In the same podcast, the AICPA stresses that SOC 2 engagements should be done annually, because things change over time.

The recurring lines to budget each year:

- **The next examination.** We recommend planning year two as a Type 2 even if the first report was a Type 1, so each period follows the last.
- **Tooling renewals**, set against the evidence hours the tool now removes.
- **Control operation**, the monthly and quarterly work that keeps the evidence trail complete.
- **Gap cover between periods.** If a report period ends well before a customer asks, you may need to explain the gap, often with a bridge letter until the next report is issued.
- **Scope changes.** New products, regions or categories make the next examination bigger.

Plan the report periods so they run back to back. A gap in coverage costs nothing on an invoice, but it costs time in every security review that spots it.

## What does a worked SOC 2 budget look like for a 60-person SaaS firm?

A worked SOC 2 budget for a 60-person UK SaaS firm has the four cost lines in three columns: a first Type 1 year, a first Type 2 year and a steady-state year two. The shape matters more than any single figure, because it shows the board which lines are one-off and which recur.

Picture a firm hosted on one public cloud, with single sign-on, managed laptops and a code review process, reporting on Security and Availability.

| Cost line | First Type 1 year | First Type 2 year | Year two onwards |
| --- | --- | --- | --- |
| Readiness and remediation | Highest: gap assessment and control build | Lower if a Type 1 came first; highest if you go straight to Type 2 | Small: only new scope or new gaps |
| CPA firm's fee | One examination at a point in time | One examination over the observation period | One Type 2 examination each year |
| Tooling | Optional for a narrow scope | Subscription for the window | Renewal |
| Internal time | Concentrated before the report date | Spread across the window | Steady monthly operation |

To turn the shape into numbers, take three like-for-like quotes for the CPA firm's fee, a fixed-scope quote for readiness, a tooling subscription quote and your own hour estimates priced from payroll.

The firm in this example already runs most of the controls a Security and Availability scope tests. Its readiness spend goes on evidence, policy and the system description rather than on new engineering. A firm without those basics should expect the readiness line to dominate the first year.

## What does an existing ISO 27001 ISMS take off the SOC 2 bill?

An existing ISO 27001 ISMS reduces SOC 2 cost by supplying controls and evidence you already run: risk assessment, access reviews, supplier management, incident response and change control. The AICPA publishes a mapping from ISO 27001 to the trust services criteria. The examination fee stays, but readiness and internal time shrink.

The [AICPA mapping of the trust services criteria to ISO 27001](https://www.aicpa-cima.com/resources/download/mapping-2017-trust-services-criteria-to-iso-27001) compares the requirements of the two frameworks category by category. Use it to find where your ISMS already answers a criterion and where it does not.

What carries over:

- **Governance**: a risk assessment, policies and management review that already have owners.
- **Operating evidence**: records your [ISO 27001](https://www.grcmana.io/vault/iso-27001) controls produce, such as access reviews and supplier assessments.
- **Audit habits**: a team used to sampling, evidence requests and corrective action.

What does not carry over is the report itself. A SOC 2 examination tests controls against the trust services criteria over its own period, and the system description is a new document.

If you are budgeting both, our [ISO 27001 certification cost guide](https://www.grcmana.io/vault/iso-27001/certification-cost) uses the same four cost lines, so the two budgets sit side by side.

## What should a SOC 2 quote include?

A SOC 2 quote should state the report type, the trust services categories, the systems and locations in scope, the period, the subservice organisations and how they are treated, the fieldwork plan and every charge on top of the fee. Without that detail you cannot tell whether a quote is cheaper or simply smaller.

Ask every firm to itemise the same things:

1. **Scope**: report type, categories, systems, locations and subservice organisations.
2. **Period and timetable**: the observation window, fieldwork dates and report delivery date.
3. **The signing firm**: the licensed CPA practice that issues the report.
4. **Method**: how the firm samples and tests, and how it tailors procedures to your system.
5. **Extras**: readiness work, bridge letters, re-testing, travel and any platform charges.
6. **Independence**: what else the firm, or anyone referring you to it, is selling you.

The Journal of Accountancy's article [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) recommends vetting the firm's size, capacity, client references and peer review results, and asking about scope, sampling and independence before you engage.

## How can you reduce SOC 2 cost without weakening the report?

You reduce SOC 2 cost by shrinking the work the auditor has to do, not the assurance the report gives. Draw a scope that matches what customers buy, arrive at fieldwork ready, let your systems produce the evidence, and compare quotes on the same scope. Buying the cheapest report usually costs more when a customer rejects it.

The savings that survive a customer's review:

1. **Scope to the contract.** Add trust services categories only when a customer requires them.
2. **Fix gaps before the window opens.** Exceptions found in a Type 2 period stay in the report.
3. **Let systems produce evidence.** Access logs, change records and backup results already exist; connect them instead of rebuilding them in spreadsheets.
4. **Reuse what you have.** An ISO 27001 ISMS supplies much of the governance and evidence.
5. **Ask whether SOC 2 is the right report.** Some buyers accept other assurance; an ISAE 3000 report is priced and scoped differently, as our [SOC 2 vs ISAE 3000](https://www.grcmana.io/vault/soc-2/soc-2-vs-isae-3000) guide explains.

Cutting the examination itself is the saving to avoid. The same Journal of Accountancy article warns that a cheap SOC 2 report may satisfy a contract but come with obvious deficiencies, and that a savvy partner will spot a cookie-cutter report.

A SOC 2 report priced like a commodity gets read like one.

The AICPA is acting on the same risk. Its [guidance to peer reviewers on SOC 2 risks](https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/) directs them to check whether SOC 2 engagement timelines are reasonable and whether engagements are tailored to each client's risks.

## Frequently asked questions

### Is a SOC 2 Type 1 report cheaper than a Type 2?

A Type 1 examination is usually smaller, because it covers the design of controls at a point in time rather than their operation across a period. The saving can be short-lived: if your customer asks for a Type 2, a Type 1 becomes an extra report on the way rather than a cheaper alternative.

### Why do SOC 2 quotes vary so much between firms?

Quotes vary because firms price different scopes, periods and levels of testing, and some bundle readiness work or tooling into the fee. A bundled quote hides what the examination itself costs, so ask for each part priced separately. Treat a quote far below the others as a question about scope and testing, not as a saving.

### Can a compliance platform issue our SOC 2 report?

Not unless it is a licensed CPA firm. The Journal of Accountancy notes that most tool providers are not CPA firms, so they cannot attest that controls are effective. A platform can organise evidence and refer you to a CPA firm, but the report must be issued by a licensed CPA practice.

### Do we still need SOC 2 if we already hold ISO 27001?

Sometimes not. Some buyers accept an ISO 27001 certificate, and others insist on a SOC 2 report for their vendor reviews. We recommend asking the customer's security team which reports they accept before you commit budget, because the cheapest SOC 2 is the one you did not need.

### What is the cheapest credible route to a first SOC 2 report?

The cheapest credible route is a narrow scope on Security, a short readiness phase that fixes real gaps, evidence drawn from your systems, and a reputable licensed CPA firm. We recommend spending on readiness rather than shaving the examination, because exceptions and rejected reports cost more than the fee you saved.