SOC 2 for CPA firms: what to do when CAS clients ask

Why are client advisory services clients asking for a SOC 2 report?

Because your CAS practice has become one of their vendors, and many of those clients are required to oversee their vendors. That oversight duty is what puts SOC 2 for CPA firms on a client's checklist. Once your staff run bookkeeping, payroll, bill pay or controller work, you hold credentials to their bank portals, accounting ledgers and payroll platforms, and you store their data in your own systems. A client's vendor review treats that access the same way it treats any outsourced provider.

Some clients face written rules on this. The FTC Safeguards Rule requires the financial institutions it covers to oversee service providers by selecting providers capable of maintaining appropriate safeguards, requiring those safeguards by contract, and periodically assessing providers based on the risk they present. The rule defines a service provider as anyone who receives, maintains, processes or is permitted access to customer information through services provided directly to the institution. SEC-registered advisers and broker-dealers have a parallel duty under 17 CFR 248.30(a)(5), which calls for due diligence and monitoring of service providers and requires providers to give notice no later than 72 hours after becoming aware of a breach affecting a customer information system they maintain. The SEC's fiscal year 2027 examination priorities say examiners will look at that oversight. A SOC 2 report is the document these clients ask for most often, because it gives them an independent opinion they can put in a vendor file.

What does a SOC 2 report actually cover?

A SOC 2 report is an independent CPA's examination of a service organization's controls, measured against the AICPA's 2017 Trust Services Criteria (with revised points of focus, 2022). The criteria cover five categories: security, availability, processing integrity, confidentiality and privacy. Security is the base of every SOC 2 examination; the other categories are added when they fit the services and the commitments a firm makes to its clients.

Reports come in two types. A type 1 report addresses whether controls are suitably designed as of a specific date. A type 2 report also tests whether those controls operated effectively over a period of time, which is why clients with formal vendor programs often ask for type 2. A SOC 2 report contains detailed descriptions of your systems and the auditor's tests. The AICPA describes SOC 3 as covering the same criteria with less detail, which makes it a general use report a firm can distribute freely, for example on its website.

Do your clients need a SOC 1 report instead?

Sometimes, and it is worth asking before you scope anything. The AICPA describes SOC 1 as an examination of controls at a service organization likely relevant to user entities' internal control over financial reporting, intended for those user entities and the auditors of their financial statements.

Outsourced bookkeeping, payroll and bill pay feed directly into a client's financial statements. When the request comes from a client's external auditor, or from a client's controller preparing for an audit, the real need may be SOC 1. When it comes from a compliance officer, a procurement team or a security questionnaire, the need is usually SOC 2. Ask each requester what report they want and what they will use it for. Some CAS practices end up needing both, and the answer changes the scope, the cost and the timeline.

Is SOC 2 required for CPA firms?

No. Neither the FTC Safeguards Rule nor Reg S-P names SOC 2. The Safeguards Rule speaks of reasonable steps and periodic assessment, and Reg S-P speaks of due diligence and monitoring. A client can meet those duties with a questionnaire, contract terms and evidence you provide. The SOC 2 expectation comes from clients and prospects, and the rules leave the method to them.

Your firm does have its own obligations that exist with or without a report. Tax preparers are financial institutions under the Safeguards Rule, so the rule's written information security program, risk assessment, access controls, MFA and service provider oversight already apply to you. Our Safeguards Rule checklist for tax preparers and the guide to updating your WISP before the 2027 filing season cover those elements. A firm that maintains them well has much of the evidence a SOC 2 auditor will ask to see.

When does a SOC 2 examination make sense for a CAS practice?

When client requests are steady, the questionnaires are taking partner time, and the CAS practice runs on consistent systems and procedures. Signals worth weighing:

• Clients with formal vendor programs, such as advisers, broker-dealers and other financial firms, make up a growing share of CAS revenue.
• Prospects' procurement teams will not sign without a report.
• The same security questionnaire arrives every month in a different format.
• The CAS team uses a defined set of platforms and a documented onboarding and offboarding process for client credentials.
• Your WISP is current and you can already produce evidence of access reviews, MFA and logging.

A SOC 2 report describes a defined system, so many firms scope the examination to the CAS service line and the platforms it runs on rather than the whole firm. Attestation standards require the service auditor to be independent of the organization it examines, so the examination is performed by another CPA firm.

What can you give clients before a report exists?

A complete, honest answer package. Many vendor reviews accept documented evidence when a SOC 2 report is not available yet, and a clear package can satisfy smaller clients outright.

• A short security summary that maps your controls to the elements of your written information security program.
• Completed questionnaires backed by evidence: MFA enforcement, device management, backup testing and access review records.
• Engagement letter terms on confidentiality, breach notification timing and return or destruction of client data when the engagement ends. Clients covered by Reg S-P will look for the 72-hour service provider notice.
• The SOC reports of the cloud accounting and payroll platforms you use, with a clear note that they cover those platforms, not your firm's own controls over who holds client credentials and how they are stored.

What should a CAS practice do this quarter?

Start with the requests you already have and the access your team already holds. These steps fit inside one quarter:

• List every CAS client that has asked for a SOC report or security questionnaire, and note which report each one asked for and why.
• Inventory every client system the CAS team can reach: bank portals, ledgers, payroll and bill pay platforms. Record how each credential is stored and whether MFA is enforced.
• Remove shared logins wherever the client's platform supports individual user accounts.
• Close gaps in your WISP that a SOC 2 auditor would test first: access reviews, logging, device management and incident response.
• If requests justify it, schedule a readiness assessment with an independent CPA firm before committing to a type 2 examination period.
• Update CAS engagement letters so notification timing and data handling match what your regulated clients need, using the counsel review list below.

What should your counsel review before you change CAS engagement letters?

Do this review before you sign or renew a CAS engagement with a client covered by Reg S-P or the Safeguards Rule, or before you accept contract terms in a client's vendor questionnaire. Bring these decisions to your counsel:

• Breach notice timing: whether your engagement letter commits to notify a client no later than 72 hours after you become aware of a breach of a customer information system you maintain, as 17 CFR 248.30(a)(5) expects of a covered client's service providers. Bring your CAS engagement letter template and any vendor addenda clients have sent you.
• Safeguards clauses clients ask you to sign: whether contract language requiring you to implement and maintain safeguards matches the controls your firm actually runs, under 16 CFR 314.4(f). Bring the client agreements or addenda and your current WISP.
• Your own vendor contracts: whether your agreements with cloud accounting, payroll and IT providers require the safeguards that 16 CFR 314.4(f) asks of your firm, which 16 CFR 314.2(h)(2)(viii) treats as a financial institution. Bring those contracts and the providers' SOC reports.

How can s90 help?

s90 manages IT and security for CPA firms across Los Angeles and Orange County. We run the controls a SOC 2 auditor tests, including identity and MFA, device management, logging and backups, and we produce the evidence your auditor and your clients ask for. Our agreements include a 72-hour breach notification commitment and 24-hour evidence production, which support the answers you give clients in vendor reviews. We do not perform SOC examinations; an independent CPA firm does. If clients are starting to ask, talk with us about a readiness review of your CAS environment.