Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
What questions should you ask before hiring an auditor?
Last verifiedWhat questions should you ask before hiring an auditor? This question bank groups accreditation, independence, scope, and price themes. Not legal advice. Not procurement advice.
Security assurance guidance, last verified 10 September 2026 against ISO/IEC 17021-1:2015, AICPA Code ET §1.200, and AICPA attestation standards. Empty or vague answers are unknowns — not a pass. Not procurement advice.
Accreditation and licensure
| Question | Good answer signals | Concerning answer signals |
|---|---|---|
| Which legal entity signs the report or certificate? | Names the CPA firm or CB legal entity matching the register entry. | Only a brand name; refuses to name signing entity. |
| Show your current register entry for this scheme. | Provides IAF/AB or AICPA peer-review entry with scope and dates. | 'We are certified' without a register link or screenshot. |
| Is your accrediting AB an IAF MLA signatory? | Yes/no with AB name; scope covers ISO/IEC 27001 or 42001 as applicable. | Unfamiliar with IAF MLA. |
Independence and scope
| Question | Good answer signals | Concerning answer signals |
|---|---|---|
| Did you sell us readiness services in the last 24 months? | Discloses relationship; offers independence safeguards or separate team. | Denies without checking; same partners on prep and audit. |
| Which Trust Services Criteria / ISO clauses are in scope? | Written scope aligned to YOUR customer contract. | Vague 'full SOC 2' without criteria list. |
| Who performs fieldwork — employees or subcontractors? | Names team; subcontractor accreditation disclosed. | Refuses to disclose subcontractors. |
Timeline, evidence, and deliverables
| Question | Good answer signals | Concerning answer signals |
|---|---|---|
| What evidence format do you accept? | Exports, read-only access, control-mapped packages; no proprietary lock-in only. | Requires a single vendor portal YOU cannot export from. |
| Timeline for Type I vs Type II / Stage 1 vs Stage 2? | Written milestones with YOUR dependencies named. | Guaranteed dates without scope review. |
| What is included in the fee — travel, retests, management letter? | Itemized proposal; change-order process documented. | Hourly open tab with no cap. |
| Report format and re-issuance if we fix findings? | Describes qualified vs unqualified outcomes; re-issuance process. | Promises unqualified opinion before fieldwork. |
What to do now
- Print this page before vendor calls.
- Record answers in YOUR RFP scorecard — empty cells are unknowns.
- Verify register claims after the call — do not trust slides alone.
- Walk independence answers against same-firm-prepare-and-audit guide on this site.
Checklist
- Register entry verified post-call?
- Independence questionnaire completed?
- Written scope and fee proposal received?
- Evidence format compatible with YOUR tooling (including ShipReady exports if used)?
- Subcontractors disclosed?
Where this shows up in ShipReady Metrics
Evidence collection, questionnaires, and obligation map surfaces help YOU answer 'what evidence do you expect?' — they do not replace auditor selection. ShipReadyMetrics does not issue reports or certificates.