Schellman — SOC 2 audit firm review

Helping clients build trust with their customers

Schellman is a leading provider of attestation and compliance services, operating as a top 100 CPA firm specializing in IT audit and cybersecurity. They perform SOC examinations, ISO certifications, FedRAMP assessments, HITRUST, PCI DSS validations, and more for global clients. Renowned for practical expertise and independence, they enable multiple compliance goals through unified assessments.

Firm tier: Mid-tier firm.

Services: SOC 1, SOC 2 Type I, SOC 2 Type II, ISO 27001, HIPAA, PCI DSS, HITRUST, FedRAMP, CMMC, GDPR.

Offices: Tampa FL; Columbus OH; Atlanta GA.

Industries served: SaaS, Technology, Fintech, Healthcare, Managed services.

Frequently asked questions

What compliance frameworks does Schellman audit?

Schellman audits SOC 1, SOC 2 (Type 1 and Type 2), SOC 3, SOC for Supply Chain, ISO 27001, ISO 42001, ISO 27701, PCI DSS, FedRAMP, HITRUST, HIPAA, CMMC, GDPR, and many more. The firm holds accreditations as an AICPA-licensed CPA, ISO Certification Body, PCI QSA, FedRAMP 3PAO, HITRUST CSF Assessor, and CMMC C3PAO.

How much does a SOC 2 audit from Schellman cost?

Schellman does not publish pricing publicly. Fixed-fee pricing is available. All engagements are custom-quoted; contact the firm for a scoping conversation. As a top-100 CPA firm specializing exclusively in IT audit and compliance, Schellman's pricing is competitive with A-LIGN.

Is Schellman AICPA-licensed?

Yes. Schellman is an AICPA-licensed CPA firm. Its peer review status is listed as unknown in publicly available records, though the firm operates under AICPA standards and is a top-100 CPA firm.

How long does a SOC 2 Type II engagement with Schellman typically take?

Schellman typically delivers draft SOC 2 reports within 2–3 weeks of completing fieldwork, per the auditor record. The full engagement including the minimum 3-month observation period runs approximately 5–7 months for mid-sized SaaS clients.

What GRC platforms does Schellman work with?

Schellman has verified working relationships with Vanta, Drata, Secureframe, and Hyperproof. The firm can receive evidence packages from all four platforms to streamline the evidence review phase.

What are Schellman's main alternatives for SOC 2 audits?

Schellman's most frequently compared alternatives are A-LIGN, BDO USA, and Moss Adams. A-LIGN is Schellman's closest direct competitor as a compliance-specialist firm; BDO USA and Moss Adams are broader national accounting firms.