A SOC 2 report carries weight only when a licensed Certified Public Accountant (CPA) firm signs it. A SOC 2 examination falls under attestation standards set by the American Institute of Certified Public Accountants (AICPA). These standards are AT-C sections 105 and 205. Only a CPA firm licensed by a US state board of accountancy can perform the examination. That same firm must also issue the opinion.
HIPAA, short for the Health Insurance Portability and Accountability Act, works differently. Federal regulation asks covered entities and business associates to run a periodic security evaluation. It does not require a mandatory third-party certification.
Founders who mix up these two paths often hire the wrong kind of help. They may also skip a step regulators expect. An auditor, at the core, is a trained reviewer who checks whether actual practice matches a required standard. The auditor gathers evidence, tests it, and reports a finding. The auditor does not build the controls directly.
This guide covers four things:
- What an auditor does
- How that role differs between SOC 2 and HIPAA work
- How internal auditors differ from external ones
- What to expect once fieldwork starts
What Is an Auditor?
An auditor definition holds across industries. An auditor is a professional who tests whether an organization’s real practices meet a defined standard. The auditor does not write policy or fix a broken control. The auditor’s task is narrower: collect evidence, measure it against a benchmark, and form an independent opinion.
This definition applies whether the standard comes from the AICPA’s Trust Services Criteria for SOC 2. It also applies to the HIPAA Security Rule and Privacy Rule. The framework changes. The auditor’s core job, gathering proof and reporting a result, stays the same.
What Does an Auditor Do in a SOC 2 Engagement?
SOC 2 examinations run under attestation standards set by the AICPA. Only a CPA firm licensed by a US state board of accountancy can perform the examination. That same firm must also issue the opinion. This rule protects the independence of the final report. A readiness consultant can help a company prepare. But that consultant cannot sign the report in place of the CPA firm.
During the engagement, the auditor tests a set of requirements. The Common Criteria, labeled CC1 to CC9, apply to every SOC 2 report. Four other categories are optional:
- Availability
- Processing integrity
- Confidentiality
- Privacy
Companies add these when customers rely on them.
The auditor also reviews a written system description from management. Management describes the system the report covers. Management follows the AICPA’s description criteria to write that description. For a deeper report type, the work extends over time. For Type 2, the audit needs evidence from across a review period, not a single date.
What Does an Auditor Do in a HIPAA Review?
HIPAA takes a different path than SOC 2. The HIPAA Security Rule requires a covered entity or business associate to run a specific check. This check covers security safeguards. The rule states a need to “Perform a periodic technical and nontechnical evaluation... that establishes the extent to which a covered entity’s or business associate’s security policies and procedures meet the requirements” of the Security Rule.
This evaluation does not require a CPA license. No single national credential governs who may complete it. Some organizations build an internal auditor function to handle the work. Others hire an outside security firm to run the evaluation and document the result.
Separate from that internal obligation, a federal agency runs its own audit program. The Office for Civil Rights (OCR) runs the HIPAA Audit Program. This program is part of OCR’s broader compliance and enforcement work. OCR uses the program to check HIPAA compliance across covered entities and business associates. This program exists for enforcement. It is not a yearly certification every covered entity must pass.
Internal Auditor vs External Auditor
An internal auditor works inside the organization as a paid employee. The Institute of Internal Auditors (IIA) defines the role as “an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations.” The internal auditor typically reports to a board or an audit committee, not to daily operations management.
An external auditor comes from an outside firm with no employment tie to the client. Internal auditors are generally employees of the company they review. External auditors are always a third party to the organization and its clients. The scope differs too. Internal audit work is typically broader than external audit work. Internal auditors can cover financial, compliance, and operational areas. External auditors focus on specific evaluations.
For SOC 2, only an outside party qualifies. Auditor independence is a key requirement, meaning the auditor must be external to the organization. For HIPAA’s periodic evaluation, either path works. A covered entity may staff an internal auditor role or hire an outside firm. Either path works, as long as the evaluation stays thorough and current.
What to Expect During Fieldwork
Fieldwork is the stage when an auditor tests evidence directly instead of reading policy documents alone. During a review, the auditor examines how a control actually functions day to day. Federal audit records describe this pattern directly: “During site visits, auditors interviewed key personnel and observed processes and operations to help determine compliance.”
Fieldwork length varies by engagement. For SOC 2, the timeline depends on company size and setup. Timelines vary based on several factors:
- Company size
- Number of locations
- Complexity of the environment
- Number of trust categories selected
Common fieldwork activities include:
- Evidence requests covering access logs, policies, and change records
- Staff interviews to test knowledge of daily procedures
- Walkthroughs of key systems and workflows
- Sampling of records from across the review period
- Auditors share a draft report with management before the final version
Each step builds toward one goal: confirming that written policy and daily practice line up. A gap between the two is exactly what fieldwork exists to catch.
Getting the Right Auditor for the Job
Choosing the right kind of auditor, internal or external, CPA-led or security-firm-led, shapes how smoothly a SOC 2 or HIPAA engagement goes. Mismatched expectations about scope, independence, or fieldwork timing cause most of the friction compliance newcomers run into. Getting clear on the auditor’s actual role, before the engagement starts, saves time and avoids a failed first attempt.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in SOC 2 and HIPAA readiness for small and midsize businesses in healthcare, SaaS, and technology. Our virtual Chief Information Security Officers (vCISOs) and compliance managers help organizations choose the right approach, prepare audit documentation, and get audit-ready without wasted time.
