Independent vs platform-preferred auditors: the hidden costs

Most compliance automation platforms maintain an auditor network or marketplace, and many surface a shortlist of "recommended" or "trusted" firms. This channel is now dominant: Drata's own published figures say over 80% of its customers meet their auditor through the platform, which lists 175+ firms in its partner program (Drata, 2025). That is a fact about scale, not conduct, and it is exactly why the structure of the recommendation matters. We are not going to make claims about anyone's specific fee arrangements. The point that matters for a buyer is simpler and more important: a curated shortlist is not the whole market, and you are rarely told what "recommended" is actually measuring.

The first cost of that is visibility on price. Buyers who only see a preferred list never learn what the rest of the market would quote for the same scope, and any curated roster reflects the platform's partner criteria, which tend to favor larger generalist firms over the specialist boutique that might be the right answer for an AI, health-tech, or fintech scope.

The deeper issue is independence, which is the entire point of an audit. The AICPA's own independence framework names "self-review" as a distinct threat: an auditor should not be put in the position of evaluating their own work. When the party that prepared you for an audit is closely entangled with the party attesting to it, that is precisely the threat the standard warns about. And when independence breaks down, the report stops meaning anything. In April 2026, a group of former customers operating as "DeepDelver" published an investigation alleging that Delve, a venture-backed compliance startup, had issued hundreds of near-identical SOC 2 reports routed through entities that were not the independent US CPA firms buyers believed they were getting; Delve was reportedly asked to leave Y Combinator over the allegations. Whatever the final facts, the episode is a clean illustration of why who signs the opinion, and how independent they actually are, is not a detail.

Common phrases to watch for in a platform's language: "trusted partners," "vetted auditor network," "preferred providers," and "platform-integrated." None of these phrases describe technical fit or price competitiveness. They describe a commercial relationship, and the buyer is rarely told what that relationship involves.

Independent marketplaces solve this by inverting the incentive. On Nomona, auditors don't pay for placement, don't pay for ranking, and don't pay for visibility. Buyers see every accredited firm that matches their scope, sorted by fit, price, and verified reviews. Paid-tier firms on Nomona pay a flat success fee when an engagement is finalized through the platform. The fee is tiered by the buyer's company size, not a percentage of the engagement value, so our revenue does not grow when an auditor inflates scope. Free-tier firms pay a flat fee per lead they choose to unlock instead. Nobody pays for ranking or visibility. And half of every success fee goes back to the buyer: as a discount you can see at checkout, or as 125% of that amount in credit toward your next audit. The fastest way to verify that independence is to ask us what percentage of our revenue comes from any single firm or placement fee.

For buyers running a first audit, the practical takeaway is straightforward: get quotes from at least two independent firms alongside any platform-preferred recommendation. Compare scope, sampling depth, and deliverables (not just the headline price). If the independent quote is materially cheaper for the same engagement, you now know what the referral fee was worth. If it isn't, the preferred firm earned it on the merits. Either way, you made the decision with the full picture, not the sales-funnel version.