Who We Insure

Insurance for Audit Firms

An audit opinion is a public promise that a set of financials can be relied upon, and that promise is what makes audit work the highest-severity professional exposure in the accounting family. When a company later restates earnings, misses a going-concern warning, or collapses after a clean opinion, the people who lent, invested, or transacted on the strength of the audit look to the firm — and their damages are measured in the size of the deal, not the size of the fee.

Why audit firms carry specialized insurance

Unlike a tax return that harms one client, an audit is designed to be relied upon by third parties the firm never met: lenders extending credit, investors buying shares, acquirers pricing a target. That reliance multiplies both the number of potential claimants and the dollars at stake, and it puts the firm's independence and quality-control discipline under scrutiny from regulators and plaintiffs alike. Workpapers, meanwhile, contain an entire client's financial environment, making the firm a rich target for data theft. A OnePark Risk advisor structures an audit firm's program around severity first — appropriate primary and excess limits, careful attention to claims-made continuity and tail — then layers the cyber and crime coverage that the concentration of client financial data demands. The objective is a tower that holds up against a reliance claim measured in the value of the audited entity, not the audit engagement.

The risk profile of an audit firm

Audit claims are defined by third-party reliance and long discovery tails: the damage often is not visible until years after the opinion, and the claimant is frequently someone other than the audited client. Key exposures: Audit-failure and restatement allegations after a client's financials are corrected; Reliance claims from lenders, investors, and acquirers who transacted on the opinion; Going-concern and judgment calls second-guessed after a client's collapse; Independence and quality-control failures raised by regulators or plaintiffs; Long discovery tails — claims surfacing years after the engagement closed; Breach or theft of workpapers containing entire client financial environments.

Accountants Professional Liability (Audit E&O) for audit firms

The core policy, and for audit firms the limits question dominates everything else. It funds defense and indemnity when the audited client — or a third party who relied on the opinion — alleges the audit failed, and defense alone in a reliance case can be substantial. Because it is claims-made and audit claims surface years later, unbroken coverage and a well-planned tail are not fine print; they are the difference between coverage and exposure. Typically responds to: defense costs for audit-failure and restatement allegations; third-party reliance claims from lenders, investors, and acquirers; settlements and judgments up to the policy and excess limits.

Excess / Umbrella Liability for audit firms

Because a single reliance claim can be measured in the value of the audited entity, primary limits are often insufficient on their own. Excess layers sit above the professional liability tower to absorb high-severity outcomes, and clients or engagement terms on larger audits frequently expect the firm to carry meaningful excess capacity. Building the tower deliberately is central to underwriting an audit practice.

Cyber Liability for audit firms

Audit workpapers hold a client's complete financial picture — bank records, ledgers, projections, and personal data — which makes the firm a concentrated target. Cyber coverage funds forensics, notification, extortion response, and third-party liability if that data is exposed, and it answers the business interruption when an engagement stalls mid-fieldwork. Underwriters will probe the firm's data-handling and access controls closely. Typically responds to: breach response and notification across affected clients; ransomware negotiation, recovery, and business-interruption loss; third-party liability where client financial data is compromised.

Crime / Employee Dishonesty for audit firms

Auditors move through client cash environments and hold privileged access during fieldwork, and both insider misconduct and social-engineering schemes exploit that position. A crime policy responds to employee theft and funds-transfer fraud with the right endorsements, covering ground the cyber sublimit does not reach.

Business Owners Policy (GL + Property) for audit firms

General liability for visitors, property coverage for the firm's own equipment, and landlord-required certificates all sit here. It is the routine backbone that lets the firm satisfy lease and vendor requirements without a separate negotiation each time.

Workers' Compensation for audit firms

Required where the firm employs staff, including audit teams traveling to client sites. It funds medical care and lost wages for injured employees — including travel-related incidents — so those costs do not fall on the firm.

Contract and certificate requirements

Audit engagements come with the heaviest insurance expectations in the group. Lenders, boards, audit committees, and acquirers frequently require evidence of professional liability at substantial limits before relying on an opinion, and larger engagements push firms toward $1 million–$5 million structures and beyond, supported by excess layers. Where the firm serves regulated or public-adjacent clients, the limits requested climb with the size and reliance profile of the audited entity. Beyond professional liability, clients handling sensitive financial data may contractually require cyber coverage at stated limits, and landlords require general liability certificates as standard. Because audit exposures are severity-driven and long-tailed, your advisor should review both the current engagement letters and the firm's tail position at every renewal so limits keep pace with the reliance the firm is taking on.

What coverage costs

As of 2026, audit-firm professional liability is priced primarily on severity: the size and industry of audited clients, the proportion of attest work, revenue, claims and regulatory history, and the height of the limits tower. A practice auditing large or public-adjacent entities will price well above a firm doing small private-company reviews, because the reliance exposure is fundamentally different. Cyber pricing reflects the concentration of client financial data in workpapers and the firm's controls around it. IBM's Cost of a Data Breach Report 2026 put the global average breach cost at $4.99 million, and for an audit firm the notification obligations span every client whose environment sits in the compromised files — which is why underwriters reward demonstrable access controls and encryption. Given the severity, a OnePark Risk advisor focuses less on a single premium number and more on structuring the primary-plus-excess tower correctly, then benchmarking that structure across carriers so the firm sees how limits and retentions move the total cost.

Illustrative example: The restatement

A firm issues a clean opinion on a mid-market manufacturer. Eighteen months later the company restates two years of revenue after an internal accounting problem comes to light, and a lender that extended a credit line on the audited figures sues the firm, alleging the audit should have caught the misstatement. Accountants professional liability assigns specialized defense counsel and funds the defense of a reliance claim; because the lender's alleged damages exceed the primary limit, the excess tower responds above it, with settlement or judgment paid within the combined limits less the retention.

Illustrative example: The going-concern dispute

A firm audits a growing software company and does not include a going-concern qualification. The company runs out of cash within the year, and investors who bought in after the opinion allege the firm ignored warning signs the financials contained. The professional liability policy funds defense of the judgment call at issue and any negotiated resolution; the claims-made structure and continuous coverage ensure the firm is protected even though the investors' claim arrives well after the engagement closed.

Illustrative example: Workpapers exfiltrated

An attacker compromises the firm's document platform and exfiltrates workpapers spanning dozens of audit clients, then threatens publication. Each affected client's complete financial environment is potentially exposed. Cyber coverage funds forensics, extortion negotiation, and notification to every affected client, and it answers third-party liability if any client's data is misused — while the firm's business-interruption loss during the platform outage is covered as well.

How much does insurance cost for an audit firm?

Audit practices sit at the high-severity end of professional services, so as of 2026 pricing turns on the size and industry of audited clients, the share of attest work, revenue, claims and regulatory history, and how tall the limits tower is. Because a single reliance claim can dwarf the fee, firms commonly build $1 million–$5 million primary structures with excess above; the useful exercise is to design the tower and benchmark it across carriers rather than chase one headline premium.

Why is audit E&O more expensive than tax or bookkeeping coverage?

An audit opinion is relied upon by third parties the firm never contracted with — lenders, investors, acquirers — so a single failure can generate multiple claimants and damages measured in the size of the deal. That reliance, combined with long discovery tails, is why carriers underwrite attest work more conservatively and price it above routine compliance work.

Is professional liability required for audit firms?

State boards of accountancy govern licensure and quality-control expectations, and firms performing attest work often face peer-review and independence requirements, but the practical driver is reliance: audit committees, lenders, and acquirers routinely require proof of coverage before relying on an opinion. Regulatory oversight of audit quality — described here only in general terms — reinforces why firms carry robust limits.

Why does the claims-made structure matter so much for audits?

Audit claims frequently surface years after the opinion, once a restatement or collapse occurs. A claims-made policy responds based on when the claim is reported, not when the work was done, so any gap in coverage — or a missing tail when partners retire or the firm winds down — can strip protection for past engagements. Continuity is essential.

How much excess coverage does an audit firm need?

There is no single answer, because the right tower depends on the size and reliance profile of the firm's audited clients. A practice auditing larger entities needs meaningfully more excess capacity than one doing small private-company reviews. Your advisor sizes the excess layers to the realistic severity of a reliance claim rather than to the engagement fee.

Do underwriters care about our independence and quality-control processes?

Yes. Documented independence policies, engagement-quality review, and quality-control systems signal a lower-risk practice, and carriers factor them into both pricing and terms. Firms that can show disciplined attest processes tend to secure better outcomes than those that cannot.

Can OnePark Risk benchmark our tower without replacing our carrier?

Yes. We review the firm's current primary and excess structure, test it against the reliance the firm actually takes on, flag any tail or continuity gaps, and benchmark the tower across the market. You decide whether to restructure — the review itself commits you to nothing.

Frequently asked questions