Bundling your SOC 2 audit means buying the readiness software and the CPA audit from one vendor; bringing your own auditor means buying the software and contracting the audit firm separately. Bundling is simpler to coordinate and can be cheaper all-in for a first audit, but it ties you to that vendor's audit firm and blends two costs into one quote. Bringing your own auditor keeps the software cost fixed and visible, lets you shop the audit on price and fit, and preserves a cleaner separation between the tool and the firm attesting to your controls. Neither is wrong; they suit different priorities.
This is a real decision now that some platforms deliver the audit in-house. Thoropass is the clearest example: it bundles the CPA audit into the same relationship as the software. Vanta, Drata, Secureframe, Sprinto, and Complies do not; they produce the evidence and you engage an auditor. Here is what actually changes between the two models, and how to pick.
What does a SOC 2 audit involve either way?
A SOC 2 report is produced by a licensed CPA firm, not by software. The firm examines your controls against the Trust Services Criteria and issues a report your customers can read. A Type 1 report covers a point in time; a Type 2 covers a window, usually three to twelve months. Software does the heavy lifting before the auditor arrives: it maps controls, collects evidence, and flags gaps, which is the work that SOC 2 compliance tooling exists to shorten. The audit itself is always a separate professional service, whether one vendor bills it or two do. For the timeline, see how long SOC 2 takes.
The bundled model: one vendor for software and audit
In a bundled model, the platform and the audit come from the same company, so one contract covers readiness and the attestation. The appeal is coordination. You are not sourcing an audit firm, comparing engagement letters, or explaining your setup twice, because the vendor that watched you get ready is the one that audits you. For a team doing its first SOC 2 with nobody who has run one before, that hand-holding is worth real money, and the all-in number can come in below buying the two pieces separately. Vendr's February 2026 data reports a median Thoropass contract of $25,964 a year, spanning platform-only and bundled deals, which is why a bundled number is not directly comparable to a software-only price.
The bring-your-own-auditor model: software plus your chosen firm
In this model, the platform produces the evidence and controls, and you contract any CPA firm you like for the audit. The software cost stays fixed and published, and the audit fee is a separate line you control. That separation buys you three things: you can shop the audit on price, since firms vary widely; you can pick an auditor with real depth in your industry; and you keep the tool and the attester independent, which some buyers and customers prefer on principle. Complies works this way on purpose. Prices are on the pricing page from $79 to $499 a month, and you bring your own auditor for the report, so the two decisions never get tangled. The tradeoff is that coordination is on you, which is more work than a bundle.
Bundled vs bring your own auditor: the tradeoffs
| Factor | Bundled audit | Bring your own auditor |
|---|---|---|
| Coordination | One vendor, one contract | You source and manage the audit firm |
| Cost visibility | Software and audit blended in one quote | Software published, audit a separate line |
| Auditor choice | The vendor's firm | Any CPA firm you pick |
| Independence | Same company builds and attests | Tool and attester are separate |
| Best for | First-timers who want it handled | Teams that want control and price leverage |
Does a bundled audit affect auditor independence?
It is a fair question, and the honest answer is that reputable bundled providers keep the audit function independent within the same company, using separate audit teams and the professional standards CPAs are bound by. The report is still issued by licensed auditors held to those rules. That said, some buyers and some of their customers simply prefer the cleaner optics of a tool and an auditor that are entirely different companies, and that preference is legitimate. If independence in appearance matters to your customers, the bring-your-own-auditor model removes the question before anyone asks it.
Which should you choose?
Choose the bundle if this is your first SOC 2, nobody on the team has run an audit, and you value having one vendor handle the whole thing more than you value shopping the audit price. Choose bring-your-own-auditor if you want the software cost fixed and visible, you have or can find an auditor you trust, or your customers care about tool-and-attester independence. A useful cross-check is cost: get a bundled quote and, separately, a software price plus two audit quotes, and compare the all-in numbers with your eyes open. Our guide to SOC 2 audit cost covers the audit-fee side, and if you are weighing the bundled approach specifically, our Thoropass alternatives page lays out both models side by side. Whichever you pick, treating the audit fee as its own budget line, the way you would any other recurring business expense, keeps the total honest.
RUN IT, NOT JUST READ IT
Turn this into tracked rows with owners
Everything in this guide becomes obligations, controls, and evidence with owners and due dates inside Complies, with a live readiness score on top. Plans from $79 a month, prices published.