[a-priori]

A SOC2's quality entirely depends on how much you trust the auditing firm.

Delve used an audit mill they paid to rubber-stamp the cookie-cutter and AI slop reports it authored. I hope it ends up in fraud charges.

But I wouldn't assume that's the case for all SOC2 reports. Any decent auditing firm should be far more rigorous.

[FinnKuhn]

These audits for Apple were done by EY.

As a German I remember that they were banned from doing certain audits in Germany until earlier this year due to their involvement in the wirecard scandal. So at least my personal believe that their audits are done rigorously is nonexistent.

https://edition.cnn.com/2023/04/03/business/wirecard-ey-ban-...

[tptacek]

Not really. The more expensive the auditor, the more they'll work with you to craft something that will avoid exceptions. There's no real "rigor" involved in SOC2! The "audit" here is in audit in the accounting sense: "do your records square up?". SOC2 auditors are generally not technical people.