What Is a Stamp Audit?

Why stamp audits exist

A stamp audit isn't usually fraud. It's economics. A buyer demands SOC 2 from a vendor, the vendor wants the cheapest report that clears the gate, and somewhere a firm agrees to do it for a fee that can't cover real testing. The report comes out clean because nobody had the hours to find anything.

I spent five years doing tech audit fieldwork at a Big 4 firm. The waste isn't in the testing — it's in everything around it. Coordination, re-requests, waiting on people, review loops. When a fee gets squeezed, the testing is the first thing to disappear, because it's the part the client never sees.

A few forces produce the stamp:

• Budget pressure. Clients push fees down every year. The firm "eats hours" — works 60, bills 30 — and quality erodes quietly. Those uncharged hours are what I call ghost hours, and they're the hidden subsidy behind a cheap audit.
• Cherry-picked samples. An auditor pulls a sample from a population — say 25 of 50 terminated employees — to test a control. If the firm over-samples, quietly discards the failures, and keeps the clean ones, the report reads spotless. Nobody re-reviews the underlying evidence, so nobody catches it.
• Inquiry without corroboration. Under AICPA attestation standards (AT-C section 205), asking someone "do you do this?" is never enough on its own. Every control needs a corroborating procedure — inspection, observation, reperformance. A stamp audit stops at the conversation and writes it up as tested.

The result is a PDF that looks like an audit and wasn't one.

How to tell you got a stamp audit

You don't need to be a CPA to spot the pattern. Five tells:

Any one of these is a yellow flag. Two or more, and you bought a stamp.

Why "we found issues" is the mark of a real audit

This is the part that feels backwards. A report full of clean checkmarks looks better than one with exceptions, so people assume zero findings means a great control environment. For a company getting SOC 2 for the first time, it almost never does.

First-time audits surface gaps — missing formal risk assessments, untested disaster recovery, no vulnerability scanning, change management that lives in people's heads. Those gaps are normal, and a real auditor names them. The point of the exercise is to find the things that aren't working yet, so you can fix them before a breach does.

If your auditor never found an issue, the audit wasn't real. Either they didn't look, or they looked and decided not to write it down. Neither is the thing you paid for. A handful of well-documented exceptions, with management responses, is a stronger signal of trust than a flawless report — because it's evidence somebody actually did the work.

The post-Delve reality

For a long time this was an inside-baseball complaint. Then it went public.

In March 2026 an analysis of reports from one compliance startup, Delve, found that 493 of 494 SOC 2 reports were nearly identical — the same paragraphs, the same grammatical errors, the same nonsensical descriptions, with only the company name, logo, and signature changed. All 259 Type II reports carried word-for-word identical auditor conclusions. The allegations went further: pre-written conclusions and test procedures sitting in draft reports before clients had submitted any evidence. Y Combinator removed the company from its directory.

That's a stamp audit industrialized — vibe compliance at scale. One template, hundreds of logos, no testing underneath.

The useful consequence is that buyers and vendor-risk teams are no longer treating a SOC 2 PDF as a green light. Legal and compliance advisories now openly tell procurement teams to read past the cover page — to check the testing detail, the exceptions, the auditor's actual procedures, not just that a report exists. A logo on a trust page used to be enough. It isn't anymore.

Which is the right instinct. The value of a SOC 2 was never the stamp. It's the data underneath — what got tested, what got found, and whether any of it is verifiable. Trust the data, not the stamp.