Start with the firm named in the independent auditor’s report. Then check its licensing record. A familiar software logo or a badge on the vendor’s website does not identify who performed the examination.
This is useful when you are choosing an auditor or reviewing a supplier’s report. It checks who stands behind the opinion. It does not replace reading what the report covers.
Get the exact name
Use the firm’s legal name rather than the name of a software platform or sales partner. If the names differ across the proposal and report, ask the provider to explain the relationship.
- Ask for the firm’s licensing jurisdiction and license number.
- Identify the person responsible for the engagement.
- Check that the report names the supplier and service you are reviewing.
Look up the license
NASBA’s CPAverify service uses licensing data supplied by state accountancy boards. It supports searches for both individuals and firms and includes disciplinary markers.
Search for the firm, not just a person with the same name. Compare the result with the details provided. Check the license status and any restrictions shown.
A missing search result is a reason to investigate, not proof that the firm is unlicensed. Check the relevant accountancy board directly. Ask the firm to resolve any mismatch before you rely on it.
Ask about quality oversight
Request the firm’s latest peer-review report and acceptance information where applicable. Peer review examines the accounting firm’s work and quality practices. It is not a second audit of your supplier.
The AICPA’s May 2026 peer-review guidance highlights the need for SOC 2 work tailored to each client. A valid license alone does not establish that the examination was suitable for the system.
If something does not line up
- Write down the specific mismatch.
- Ask for clarification through a contact you have independently checked.
- Do not upload a restricted SOC report to an unfamiliar verification website.
- Keep unresolved questions visible in your buying or vendor-review decision.
For example, a platform may sell the package while a separate CPA firm issues the report. That difference is not automatically a problem. The important part is being able to identify and verify the actual firm.
Once the identity checks are complete, review the report’s scope and findings. Our guide to SOC 2 exceptions explains what to do when the testing found a problem.
Further reading: AICPA SOC resources and service-evaluation guidance.