The conflict of interest hiding in your compliance platform

If you've shopped for a SOC 2 or ISO 27001 audit through a modern compliance platform, you've almost certainly been handed a shortlist of "recommended" auditors. This channel is now dominant: Drata's own published figures say over 80% of its customers meet their auditor through the platform, which lists 175+ firms in its partner program (Drata, 2025). That is a fact about scale, not conduct, and it is exactly why the structure of the recommendation matters. What is easy to miss is that a "recommended" shortlist and an independent ranking of fit and price are not the same thing. Most major automation platforms maintain some form of auditor network or marketplace, and a curated list reflects who fits that program, which is not necessarily who fits your scope or your budget. The mechanics vary by platform, and we are not asserting anything about specific fees; the point is that the buyer is rarely told what "recommended" is measuring.

On its face, this looks like a tidy ecosystem: the platform brings the buyer, the auditor closes the engagement, everyone wins. In practice, the incentives quietly tilt the playing field. A firm outside the partner program is invisible on that surface, even when it is a better technical or pricing fit. Smaller, specialized firms (often the most independent voices in the market) are systematically pushed down the list. And buyers, who assume they're seeing a curated set of qualified options, are actually seeing a sales funnel.

The problem isn't that auditors and platforms talk to each other. It's that the relationship behind the recommendation is invisible to the buyer at the moment of decision. The steering is often informal, not a disclosed fee, which makes it harder to detect, not easier.

There's a second-order effect that gets less attention: auditor independence itself. An audit firm that depends on a single platform for a meaningful share of its pipeline is structurally compromised. If the platform's customers underperform a control, who does the auditor want to please: the company being audited, or the partner sending the next ten leads? The further the buyer-auditor relationship is mediated by a commercial intermediary, the harder it is to trust the opinion at the end of it. This is not a fringe concern: the AICPA's independence framework treats self-review and undue influence as named threats to an audit opinion, which is exactly what a pipeline dependency can create. Certification bodies face the same requirement: ISO/IEC 17021-1 clause 5.2 obliges them to manage threats to impartiality. The profession itself is raising the flag: the Journal of Accountancy published a piece on ethics risks in arrangements between SOC 2 auditors and tool providers in April 2026.

We built Nomona on the opposite premise. Auditors don't pay for placement, and buyers see every qualified firm that matches their scope, ranked by fit, price, and verified independence rather than by partnership status. Independence isn't a marketing claim; it's a structural choice about who pays whom, and for what.