If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does the spec require that it be some credentialed 3rd party who does the review and report? Or, can we DIY this? Is there any requirement in the spec as to WHO does the audit and report?
The answer is yes, it does need proper credentialing. You cannot do it yourself.
The ruling is very specific on this:
A SOC audit can only be performed by an independent Certified Public Accountant (CPA) or accountancy organisation. SOC auditors are regulated by the AICPA; they must adhere to specific professional standards established by the AICPA. They are also required to follow specific guidance related to planning, executing and supervising audit procedures. AICPA members are also required to undergo a peer review to ensure their audits are conducted in accordance with generally accepted auditing standards.
CPA organisations may employ non-CPA professionals with relevant information technology and security skills to participate in preparing for a SOC audit, but the final report must be provided and issued by a CPA. A successful SOC audit carried out by a certified CPA permits the service organisation to use the AICPA logo on its website.
For more useful information, read the whole page https://www.itgovernance.co.uk/soc-reporting