Accounting, CPA & Audit Firms
What insurance does a SOC 1 or SOC 2 audit firm need?
A firm performing SOC 1, SOC 2, or another technology-attestation engagement should describe the actual attestation and advisory services to its insurance advisor and review professional liability, cyber, crime, excess, and ordinary business coverages together. The right program depends on the report type, client systems, reliance group, subcontractors, data access, contractual requirements, and policy forms. SOC terminology and professional standards do not guarantee that an insurance policy covers a particular allegation. General insurance education, not legal, accounting, actuarial, professional-standards or policy-specific advice. Coverage depends on the policy form, endorsements, limits, deductibles, exclusions, jurisdiction and facts. Submission does not bind coverage or guarantee a quotation or carrier approval.
Key takeaways
- Distinguish an attestation report from implementation, readiness, consulting, or managed-security work.
- Map who may rely on the report and what the engagement letter says about intended use.
- Describe the systems, data, cloud environments, and credentials the team can access.
- Cyber and crime answer different loss paths from professional liability and may contain important conditions or sublimits.
- Use the applicable AICPA standards and the actual engagement documents when completing a submission.
Describe the report and the work behind it
“SOC work” can refer to an examination that results in a report, a readiness assessment, implementation advice, controls outsourcing, or a technology consulting project. The professional exposure changes when the firm moves from evaluating controls to designing or operating them. A submission should show revenue and engagement counts by service, the relevant report framework, whether the work is recurring, and who is responsible for the final report.
The distinction is not a judgment about which service is safer. It lets an advisor compare the engagement promise with the professional-liability form and identify any technology-services or management-consulting exposures that need separate treatment. Do not use an attestation label to hide implementation or managed-service work.
Reliance, distribution, and contract terms
A report may be prepared for a service organization but reviewed by customers, boards, investors, regulators, or other parties. The engagement letter and report should be read together for intended users, permitted distribution, representations, limitation language, confidentiality, and record access. This page does not interpret those terms or decide whether a third party can sue.
Enterprise clients may request evidence of professional liability, cyber insurance, crime coverage, or specified limits. Compare every requested term against the declarations and endorsements, including additional-insured or contractual-liability wording where relevant. A certificate cannot rewrite a policy or expand the scope of an attestation engagement.
Technology access creates a second risk track
The engagement team may access system descriptions, configurations, logs, tickets, employee records, credentials, and sensitive customer information. A compromise of the firm or a cloud collaboration tool can create incident-response, notification, and client-claim questions even when the attestation work itself was accurate. Inventory where evidence is stored, who can export it, and how long access persists after the report is issued.
Crime exposure also deserves separate attention when staff can change payment instructions, access client funds, or administer privileged accounts. Cyber coverage and crime coverage are not interchangeable, and the policy definitions, endorsements, controls warranties, and sublimits matter. Ask the advisor to test a hypothetical incident against actual wording rather than describing a package as complete.
SOC practice submission checklist
A good submission explains the work in the language of engagements and systems, not only the name of the report. Include examples of the largest or most sensitive assignments, the percentage of revenue from report work versus readiness or implementation, and the controls the practice uses to protect evidence. Disclose prior incidents and claims according to the application’s instructions.
- Revenue and engagement count by SOC report, readiness, consulting, and managed service
- Frameworks used, report periods, intended users, and distribution restrictions
- Typical client industries, system types, data categories, and reliance profile
- Professional staff qualifications, quality review, subcontractors, and offshore access
- MFA, privileged access, encryption, logging, backups, retention, and incident response
- Current policies, client insurance requirements, claims, complaints, and circumstances
Service distinction for an insurance review
| Work described | Primary description question | Potential review focus |
|---|---|---|
| Attestation report | What report and intended users? | Professional liability and reliance |
| Readiness assessment | Does the firm advise before an examination? | Scope, advice, and deliverables |
| Implementation | Does the firm design or install controls? | Technology E&O and project responsibility |
| Managed service | Does the firm operate controls or systems? | Ongoing operational and cyber exposure |
Hypothetical: Illustrative SOC engagement change
A practice historically performed SOC 2 examinations and begins configuring a client’s identity platform. The renewal submission separates the two services, explains access and responsibilities, and provides the relevant engagement documents rather than assuming the examination classification covers implementation work.
Additional questions
Does a SOC 2 report replace professional-liability coverage?
No. A report describes controls within its stated scope and period; it does not insure the practitioner. Review professional liability, cyber, crime, and contract requirements separately.
Is cyber insurance enough for a SOC practice?
Not necessarily. Cyber addresses certain data and system events, while professional liability addresses alleged errors in services and crime may address theft or payment fraud. Forms and facts control.
Sources
- AICPA: SOC for service organizations — accessed 2026-09-13; supports SOC reporting context and distinction between report services..
- AICPA: System and Organization Controls — accessed 2026-09-13; supports AICPA SOC resources; standards and engagement facts must be confirmed..
- National Institute of Standards and Technology: Cybersecurity Framework — accessed 2026-09-13; supports Risk-management concepts for organizing technology controls..
General insurance education, not legal, accounting, actuarial, professional-standards or policy-specific advice. Coverage depends on the policy form, endorsements, limits, deductibles, exclusions, jurisdiction and facts. Submission does not bind coverage or guarantee a quotation or carrier approval.