Accounting, CPA & Audit Firms
Insurance for SOC and Technology-Attestation Firms
SOC and technology-attestation practices should present an insurance submission that separates examinations and reports from readiness, implementation, managed services, and other consulting. Professional liability is the core service coverage; cyber and crime address data, systems, and money-movement exposures where the facts and forms support them, while excess and ordinary business coverages depend on contracts and operations. A SOC report is not an insurance guarantee, and AICPA standards and client contracts require separate review. General insurance education, not legal, accounting, actuarial, professional-standards or policy-specific advice. Coverage depends on the policy form, endorsements, limits, deductibles, exclusions, jurisdiction and facts. Submission does not bind coverage or guarantee a quotation or carrier approval. General insurance education not legal accounting or policy-specific advice.
Key takeaways
- Describe each report type, framework, period, intended user, and distribution channel.
- Separate examination work from control design, implementation, and managed services.
- Map evidence storage, cloud tools, privileged access, subcontractors, and retention.
- Review enterprise contract terms against actual declarations and endorsements.
- Use current AICPA resources for SOC standards questions and an insurance advisor for policy alignment.
Build the program around actual services
A technology-attestation firm can examine controls, advise on readiness, implement systems, or operate a managed control. Those are not interchangeable descriptions. Set out revenue, engagement count, staff role, deliverables, client systems, and responsibility for control operation. This gives the advisor a factual basis for comparing professional-liability and technology-services terms.
The firm should not rely on SOC branding to imply a broader insurance response. A report’s scope, period, and intended users belong in the engagement and standards review; the policy review asks separate questions about services, claims, data, contracts, and controls.
Enterprise contracts and reliance
Enterprise customers may request proof of professional liability, cyber, crime, or excess coverage. They may also impose security, notification, audit-right, confidentiality, and subcontractor requirements. Compare the request against the policy and avoid promising that a certificate changes an exclusion or creates a new insured.
Ask who may rely on the report, whether it can be distributed outside the customer, and what the engagement says about client-provided information. A claim alleging an inaccurate report and a claim alleging a data incident may involve different coverage parts, defenses, or notices.
Controls that should be visible in the submission
The submission should explain identity management, MFA, privileged access, logging, evidence transfer, encryption, backups, endpoint management, vulnerability response, and the use of cloud collaboration tools. It should identify which controls are operated by the firm and which belong to the customer or a vendor.
Crime questions arise if personnel can change payment instructions or use privileged customer credentials. Cyber questions arise if evidence, credentials, or personal information are compromised. A practical review tests these paths against the actual endorsements and conditions rather than assuming one policy responds to every event.
A defensible practice-review process
Use a service-and-system register at proposal, mid-engagement, and renewal. Record the report, framework, period, client industry, systems, intended users, data, subcontractors, and insurance requirements. Mark every item as confirmed, pending, or requiring specialist review.
- Service mix and revenue by attestation, readiness, implementation, and managed service
- Report types, intended users, distribution, client industries, and reliance profile
- Professional staff, quality review, subcontractor, and offshore-access details
- Cloud platforms, evidence retention, privileged accounts, MFA, and backups
- Contracts requiring E&O, cyber, crime, excess, notification, or security terms
- Current policies, claims, incidents, complaints, and renewal application history
SOC practice workstreams
| Workstream | What the client receives | Insurance discussion |
|---|---|---|
| Attestation | Report on defined controls | Reliance and professional-liability exposure |
| Readiness | Gap or preparation advice | Advisory scope and deliverable risk |
| Implementation | Configured controls or systems | Technology E&O and project responsibility |
| Managed service | Ongoing operation | Operational, cyber, and contractual exposure |
Hypothetical: Illustrative client expansion
A SOC practice is asked to implement a customer’s identity system after issuing a report. Before accepting, it separates the implementation scope, reviews access and subcontractors, updates its service inventory, and asks for an insurance review instead of assuming the original attestation classification follows the new work.
Additional questions
Can a technology-attestation practice use ordinary CPA coverage?
It may be relevant, but the actual report, advisory, implementation, data, contract, and reliance profile must be compared with the form. Do not assume a label is sufficient.
Do clients usually ask for cyber evidence?
Enterprise requirements vary. Ask for the customer’s written request and compare it with actual policy evidence and controls rather than relying on a generic certificate.
Sources
- AICPA: SOC for service organizations — accessed 2026-09-13; supports SOC reporting and service-organization context..
- AICPA: System and Organization Controls — accessed 2026-09-13; supports AICPA SOC resources for standards research..
- National Institute of Standards and Technology: Cybersecurity Framework — accessed 2026-09-13; supports Risk-control organization..
General insurance education, not legal, accounting, actuarial, professional-standards or policy-specific advice. Coverage depends on the policy form, endorsements, limits, deductibles, exclusions, jurisdiction and facts. Submission does not bind coverage or guarantee a quotation or carrier approval.