One place for independent compliance auditors

Independent auditors, assessors, consultants and audit firms who audit or assess organizations against HIPAA or any of the other 17 frameworks in the list — SOC 2, ISO 27001, PCI DSS, HITRUST, NIST, CMMC, GDPR, India’s DPDP Act and more.

Yes. Auditors and firms who enroll before the directory launches in December 2026 pay nothing to enroll, and founding members’ listings stay free until 31 May 2027. After that the founding rate of USD 100 per year is locked for two years. Listings for auditors who join after launch start at USD 100 per year. Nothing is charged automatically: we confirm your plan with you before any invoice.

No. Listings are a flat annual fee. We don’t take a commission on introductions, and we don’t pay or accept referral fees or kickbacks. When we subcontract you on our own client work, your rate is agreed with you in writing before the work starts.

No. There is no official HIPAA auditor certification, and HHS does not endorse private “HIPAA certifications”. A listing shows what you audit and which credentials we have confirmed with their issuers — please don’t describe it as a certification.

No. List the frameworks you actually audit. HIPAA experience helps with healthcare engagements, and every profile shows its full scope, so organizations outside healthcare can find you too.

A person checks each credential with its issuer — through a public register or verification service where one exists (for example ISACA, ISC2, CPAverify, the PCI Security Standards Council or the Cyber AB), or directly with the issuing body — and records the date. Until then the credential is shown as pending verification.

No. Verification cannot be bought, and a listing is not an endorsement: “Verified” means we confirmed that credential with its issuer on the date shown, nothing more.

No. Your public profile shows your name, location, scope, services and credentials. Organizations send requests through HIPAA Auditors, and we introduce you when the scope fits.

Only licensed CPA firms can issue SOC 2 reports, and ISO certificates are issued by certification bodies. If your firm holds that authority, add it under firm authorizations and we will verify it. Otherwise your profile shows readiness, gap and internal audit work for those frameworks — which is just as valuable when it is labelled correctly.

When an organization’s request matches your scope, we send you the details and ask you to confirm you have no conflict with that client — for example, readiness or implementation work you did for them. We share your contact details with the client only after you agree to the introduction. Fees, timelines, NDAs and — where protected health information is involved — a business associate agreement are agreed before any work starts.

While your profile is listed, and for 12 months after you withdraw or an application is declined; then it is deleted. You can withdraw any time from your private link, and ask us to delete your data sooner. The Auditor Network terms explain what we collect and why.

Once your profile is reviewed, we email you a private link to edit it. Changes go live straight away; new or changed credentials are re-checked before they show as verified.