Should You Switch Audit Firms? What Changing Auditors Really Costs

Nothing stops you from changing audit firms, and that is the problem: the barrier is low, so companies switch for the wrong reason and pay the bill afterwards. The bill has three lines that appear in no quote. A new firm will not rely on the previous firm's testing, so someone has to test the months you already paid to have tested, and whether the successor can do that from the evidence you kept decides whether the window survives, shortens or restarts. Someone rewrites and re-defends the system description. And a year of accumulated context about why your controls look the way they do walks out of the building. In financial-statement audits the handover is a formal procedure: PCAOB AS 2610 bars a successor auditor from accepting the engagement until it has made specific inquiries of the predecessor, and requires it to ask you to authorise a review of the predecessor's working papers.

Switch at a period boundary, and switch for a named defect rather than for a lower quote. The rest of this is what the standards actually require, what the three costs look like in practice, and the four reasons that genuinely justify the move.

Key takeaways

• There is no rotation requirement and no minimum tenure for a SOC 2 service auditor. You can change firms whenever you like, which is why the decision needs its own discipline.
• A successor firm does not inherit the incumbent's testing. It has to test the whole period itself, which it can often do retrospectively from evidence you retained and sometimes cannot, so a mid-window switch may cost you a shortened or restarted period. Time the move to a period boundary and the question does not arise.
• The handover has a published shape, borrowed rather than binding: PCAOB AS 2610 governs financial-statement audits and does not apply to a service auditor, but it requires the successor to make specific inquiries of the predecessor and to request access to their working papers, and reputable attestation firms run substantially the same play.
• Four things justify a switch: missing competence for your scope, repeated calendar failures, churn that makes you re-explain your environment every year, and an opinion or exception you cannot defend to customers.
• Price alone almost never justifies it. The saving is one-time and the relearning cost recurs.

The barrier is low, which is why the decision goes wrong

Financial-statement audits at listed companies operate under partner rotation rules and audit committee oversight, so changing firms is a governed event with paperwork and disclosure. Nothing comparable governs a SOC 2 examination. Your service auditor holds no statutory tenure, there is no mandated rotation, and no regulator has to be told. You send an email.

Because it is easy, the decision usually gets made for the easiest reason available, which is a competing quote. That is the single worst basis for it, and the rest of this article is essentially an argument for why.

The comparison that matters is not this year's fee against next year's fee. It is this year's fee against next year's fee plus the three costs below, spread over however many years you would have kept the incumbent.

What the standards actually require at handover

AS 2610 governs audits of financial statements, not SOC examinations, so it does not bind your service auditor directly. It is worth reading anyway, because it is the clearest published description of what a competent handover looks like and reputable attestation firms run substantially the same play.

Paragraph .03 states that an auditor should not accept an engagement until the predecessor communications have been evaluated. Paragraph .09 requires the successor to make specific and reasonable inquiries of the predecessor about matters bearing on the decision to accept, and names them: information that might bear on the integrity of management, disagreements over accounting principles or auditing procedures, communications about fraud and internal control matters, the reasons for the change of auditors, and related party relationships. Paragraph .11 requires the successor to ask the client to authorise a review of the predecessor's working papers, and notes that the predecessor decides which papers are made available while ordinarily permitting access to material of continuing significance.

Three things follow for you. First, the reason you are leaving is a question the new firm is expected to ask the old one, so the story you tell each of them should be the same story. Second, the handover requires your authorisation, which means you can help it or obstruct it, and obstructing it is read exactly as you would expect. Third, the successor reviewing the predecessor's papers is not the same as the successor relying on their testing, which is the distinction that costs you a reporting period.

The three costs nobody puts in the quote

The reporting period. A Type 2 opinion covers a stated observation window, and the firm signing it has to have tested the controls across that window itself. A new firm arriving in month eight of a twelve-month window does not adopt the first seven months of someone else's fieldwork. What it can do is test those seven months itself, and how far it gets is decided by what you retained rather than by who tested it originally. Where a control leaves a durable record, tickets, approvals, logs, signed access reviews, the successor can examine it after the fact, and fieldwork performed after a period ends is ordinary rather than exceptional. Where the only record that the control operated was the predecessor's working papers, or where the procedure was an observation that had to happen at the time, those months are not recoverable by anyone.

So there are three outcomes, not two: the original window stands, you take a shorter first period from the new firm and explain the shape to your customers, or the window restarts. Which one you get is a question for the candidate firm during selection, not a discovery you make in month nine. All three are manageable when planned and expensive when discovered, and the difference between them is largely the quality of your own evidence retention.

The system description. Section 3 of a SOC 2 report is a human-authored narrative of your system, its boundaries, its components, the subservice organizations you depend on, and what your customers are expected to do on their end. A new firm reads it with fresh eyes and will have views. Some of those views will be improvements. All of them cost revision cycles, and revision cycles land on the same small number of people who were already busy.

The context. The incumbent knows why your change management process has the exception it has, why one legacy system is scoped the way it is, and which of your controls looked fragile last year and got fixed. None of that is written down in a form the next firm can absorb quickly. You will re-explain your environment, and the re-explaining is where teams volunteer information they did not need to volunteer, a failure mode we cover in our piece on auditor walkthroughs.

Four reasons that justify a switch

They do not have the competence your scope now needs. You added a second framework, moved into a regulated sector, or acquired a company with an environment your firm has never audited. Competence is scope-specific and firms are honest about this more often than buyers expect. Ask directly how many engagements like yours they signed last year.

Repeated calendar failure. Fieldwork that slips, reports that arrive weeks after the date you were given, requests that arrive in batches with no notice. One slipped date is a bad quarter. A pattern is a capacity problem at their end that will not improve because you asked nicely, and it will eventually cost you a customer deadline.

Churn that makes you the institutional memory. If you have re-explained your architecture to a new engagement team three years running, you are subsidising their training with your team's time. This is a legitimate reason to move, and it is the one most often mistaken for a personality problem.

An opinion or exception you cannot defend. Not an exception you dislike, an exception you cannot explain. If your firm cannot articulate why a finding is written the way it is, or the report's language is causing avoidable friction in customer security reviews and they will not discuss it, that is a communication failure with commercial consequences. Note the boundary carefully: wanting a firm that explains its findings is legitimate; shopping for a firm that will not write them is opinion shopping, and it is visible to everyone downstream.

Three reasons that do not

A lower quote. The saving happens once and the relearning cost happens once too, which sounds like a wash until you count the reporting-period risk and the revision cycles on top. If price is the real driver, take the competing quote to the incumbent first. Firms renegotiate, and a renegotiation costs you nothing but a conversation.

One uncomfortable finding. An auditor who writes an exception you did not want is an auditor doing the job. A report with nothing in it is worth less to your customers than a report that shows something was actually looked at, and sophisticated vendor risk reviewers know it. Fix the control instead, using the structure in our guide to remediation plans auditors accept.

A rotation policy you made up. Some companies rotate auditors on principle, borrowing the independence logic from listed-company financial audits. That logic exists because a statutory audit protects public investors and the rules are written accordingly. Nothing equivalent applies to a service auditor, and rotating for its own sake buys you the three costs above with no corresponding benefit.

How to switch without losing a reporting period

Sequence matters more than anything else in this article.

Start the conversation with candidate firms at least one full quarter before your current period ends, and tell them the period end date in the first call. Ask each candidate one specific question: given our current window closes on this date, what observation period can you sign, and when. The answers differ, and the difference is the whole decision.

Sign the successor before the current period closes, not after, so the transition happens across a boundary rather than through one. Then authorise the predecessor communications promptly. Slow-walking the AS 2610-style handover is the most common self-inflicted delay in an auditor change, and it also reads badly to the firm you are trying to hire.

Expect a coverage question from customers and answer it before they ask. If there is a gap between your last report's period end and the new firm's first period start, understand what a bridge letter can and cannot do about it: your own leadership writes it, no standard governs it, and a customer can decline to accept one. Tell your largest accounts the report is coming from a different firm before they discover it on the cover page.

Finally, hand over deliberately. Give the successor the previous report, the previous exception list and the remediation evidence, and write down the three or four "why is it like this" explanations you have been giving verbally for years. That document is worth more than anything else in the transition.

When you do not need help with this

We sell audit management, so it is worth saying plainly that an auditor transition is often a two-week project you can run yourself.

If you have one framework, a stable scope, and someone internal who owns the compliance calendar, the work is: shortlist three firms, ask each the period question above, check references from companies your size, sign before the period boundary, and authorise the handover. That is a procurement exercise, not a consulting engagement, and the questions in our guide to vetting a SOC 2 auditor are enough to run it.

Buy help when the transition is entangled with something else: a scope change, a second framework arriving at the same time, an acquisition, or a customer deadline that leaves no room for a restarted window. The complexity is what justifies the spend, not the switch itself.

Where Top Floor fits

We manage audits, we do not perform them. Our audit and assurance work is shortlisting and vetting candidate firms, running the transition against your period boundary, and then handling evidence requests, auditor questions, walkthrough scheduling and findings once fieldwork starts. The engagement letter stays between you and the CPA firm, because that separation is what makes the resulting report worth having.

If the reason you are switching is really that nobody owns the programme between audits, changing firms will not fix it and compliance as a service is the actual purchase. If you are still choosing your first firm rather than replacing one, our writeup on whether your auditor's brand matters is the better starting point.

How to decide this week

Write down the specific defect in one sentence, without using the word "expensive". If you cannot finish the sentence, you do not have a reason to switch yet; you have a negotiation to run, so take your competing quote to the incumbent and run it.

If the sentence writes itself, put your current period end date on a calendar and count backwards one quarter. That date is when the shortlist has to start. Then call your three largest customers' vendor risk contacts and ask what they would need to see if your next report came from a different firm, because their answer tells you whether a short first period is acceptable or whether you need to protect the full window.

Do those two things before you take a single sales call, and the sales calls get much shorter.

Frequently asked questions

Can you change SOC 2 auditors between reports?

Yes, at any time and without anyone's permission. There is no mandated rotation for a service auditor, no minimum tenure, and no regulator to notify. The practical constraint is timing rather than permission: a new firm has to test the controls across the period it signs an opinion on, so a change made partway through an observation window means the successor has to test the earlier months itself rather than inherit them. It can often do that retrospectively from evidence you retained, and where it cannot you are choosing between a shorter first period and a restarted window. Ask each candidate firm what period it can sign before you commit, and time the change to fall at a period boundary if you can, because then the question does not arise.

Does the new auditor get the old auditor's working papers?

They ask for access, and you authorise it. In financial-statement audits PCAOB AS 2610 paragraph .11 requires the successor to request that the client authorise a review of the predecessor's working papers, with the predecessor deciding which papers are made available while ordinarily permitting access to material of continuing significance. Attestation practice follows the same pattern. Reviewing those papers is not the same as relying on the predecessor's testing, though: the successor still performs its own procedures over the period it will opine on, which is why a mid-period change costs you the period.

Is switching auditors a red flag to customers?

Only if you handle it badly. Vendor risk reviewers look at whether the report was issued by a licensed CPA firm, which criteria and period it covers, whether the opinion is unmodified, and what the exceptions say. A different firm name on the cover is rarely a question on its own. It becomes a question when it arrives unannounced alongside a shortened period or a gap in coverage, so tell your largest accounts before the report lands and explain the period shape in the same message.

Should we switch auditors to get a cheaper quote?

Almost never on its own. The saving is one-time, while the costs of the change (a possibly restarted observation period, revision cycles on the system description, and re-explaining your environment to a new team) land immediately and partly recur. The better move is to take the competing quote to your current firm and ask them to meet it, which costs you one conversation. Switch when there is a defect you can name in a sentence: missing competence for your scope, repeated missed dates, constant team churn, or findings the firm cannot explain.