SOC 2 by industry
SOC 2 for accounting firms and professional services: client portals, engagement teams and offshore delivery
What changes when the service organisation is an outsourced accounting, bookkeeping, tax, legal process or consulting firm: SOC 1 or SOC 2, what belongs in scope, where examiners sample, and how the report sits beside ISO/IEC 27001 and professional duties.
Key points
- For an outsourced accounting, bookkeeping, tax or legal process firm, the first question is often SOC 1 or SOC 2: when your work flows into a client's financial statements, their external auditor usually wants SOC 1.
- SOC 2 answers a different buyer: the client's IT security, risk or general counsel's office, asking how you protect confidential financial, tax and legal files.
- The system in scope is the delivery engagement, not the firm: client portals, document and practice management systems, the engagement teams and any offshore delivery centre that touches client data.
- Examiners sample hardest on engagement-level access, confidentiality through to file disposal, and your oversight of the cloud accounting, tax and portal vendors the work runs on.
Why accounting and professional services firms are asked for SOC 2
The request usually reaches the managing partner or the head of delivery through a client's vendor onboarding. A company outsourcing its bookkeeping, a legal department sending contract review to a legal process provider, or an accounting practice moving tax preparation offshore: each hands over confidential records and wants assurance over the people and systems holding them.
Two buyer groups drive the demand. Corporate clients' security and procurement teams, with questionnaires about portals, encryption and staff vetting. Accounting and law firms that subcontract work to you need to show their own clients how they oversee that subcontracting.
What changes in this sector is that the data is the service. Ledgers, payroll files, tax returns, due-diligence data rooms and privileged correspondence move between the client, your portal and your engagement team every day, often across borders.
SOC 1 or SOC 2 for an accounting firm
SOC 1 reports on controls relevant to your clients' financial reporting; SOC 2 reports on security and, where you choose, confidentiality, availability, processing integrity and privacy. The full comparison is in SOC 1 vs SOC 2: which report your clients need, and the SOC 1 side for this sector in SOC 1 for finance and accounting BPO. In this sector the practical test is who is asking. If a client's external auditor wants to rely on the journals you post, the reconciliations you prepare or the payroll you run, SOC 1 is usually the report they expect. If the client's security or legal team wants to know that its files are safe with you, SOC 2 is the answer.
Many firms end up with both. Month-end close and payables processing call for SOC 1; the client portal, document management and staff access call for SOC 2. The two reports share access, change and vendor controls, so one control set can feed both examinations.
What sits inside the scope for a professional services firm
The system description names the service lines covered, the client portal and file-exchange tools, the document or practice management system, the accounting and tax platforms your teams log into, the identity provider and e-mail, and every delivery location, including an offshore centre and staff working from home.
Three scope mistakes recur here: scoping the firm's head office while the work is done at an offshore delivery centre; leaving out the portal vendor or cloud accounting platform instead of presenting it as a subservice organisation; and describing every practice area when only one service line has a client asking. The general rules are in SOC 2 scope: system boundaries, trust services categories and carve-outs.
Where the criteria bite for accounting and professional services
| Criteria area | What it means in a professional services firm | Evidence the examiner samples |
|---|---|---|
| CC6 Logical and physical access | Each engagement team sees only its own clients' files, ledgers and matters, and access ends when a person leaves the engagement or the firm | Engagement-level folder and portal permissions, access to clients' accounting systems granted and removed, periodic reviews by engagement managers, multi-factor authentication |
| C Confidentiality | Client records are classified, retained for the agreed period and returned or destroyed when the engagement ends | Retention schedules, engagement letters with confidentiality terms, disposal or return records at engagement close, restrictions on downloads and removable media |
| CC1 Control environment | Staff at every location, including offshore teams and contractors, are vetted and bound to confidentiality | Background checks, signed confidentiality and code of conduct acknowledgements, onboarding training records |
| CC7 System operations | Detecting phishing, mailbox compromise and unusual file access around deadlines such as tax season and month-end | E-mail security alerts, file-access monitoring, incident tickets with client notification decisions, restore tests of document stores |
| CC9 Risk mitigation: vendors | Oversight of the portal, document management, cloud accounting and tax software providers the service depends on | Vendor inventory, review of each provider's SOC reports and the user controls they require, contracts with security terms |
The full criteria set is explained in SOC 2 Trust Services Criteria explained, criterion by criterion.
How SOC 2 works alongside SOC 1, ISO/IEC 27001 and professional duties
Professional firms already carry confidentiality duties under their own professional and contractual rules. SOC 2 does not replace them; it evidences that the systems behind them operate. International clients often ask for ISO/IEC 27001 certification beside the report, and one policy set, one risk assessment and one evidence calendar can serve both; see SOC 2 vs ISO/IEC 27001: which one, or both?
Duration depends on how many service lines and delivery locations are in scope, whether engagement access is already managed centrally, and when the client needs the report. The managing partner or practice lead, the delivery head, IT and whoever owns vendor contracts must be involved. With Design™, Sterling guides your team to own the controls; with Drive™, Sterling carries more of the documentation, evidence and readiness testing so fee earners stay on client work.
How Sterling works with accounting and professional services firms
One control set for the portal, the engagement team and the offshore floor.
Our expert and experienced consultants help you decide between SOC 1, SOC 2 or both, map the criteria to your portal, document management and engagement workflows, test the controls the way the CPA firm will before the period starts, and keep the evidence in Effivity, included with the engagement. Sterling does not issue the report; an independent, licensed CPA firm examines and opines. We ensure a successful SOC 2 examination for our clients.
Book a free discovery callSOC 2 for accounting firms: questions buyers ask
Does an outsourced bookkeeping firm need SOC 1 or SOC 2?
Usually SOC 1 if clients' auditors rely on your bookkeeping, and SOC 2 if clients ask how you protect their data. Many firms obtain both from one control set.
Our tax and accounting software vendor has a SOC 2 report. Does it cover us?
No. It covers the vendor's platform controls. Who in your firm can reach client files, how access is removed and how records are disposed of remain yours to evidence.
Do offshore delivery centres have to be in the SOC 2 scope?
Yes, if staff there handle the in-scope clients' data. Leaving them out makes the description inaccurate.
Should confidentiality be in scope for a legal process outsourcing firm?
In most cases, yes. Clients send privileged and commercially sensitive material, and the confidentiality criteria test how you classify, retain and dispose of it as agreed.
SOC 2 by industry
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 for accounting and professional services
- SOC 2 bridge letters, report validity and the annual cycle explained
- SOC 2 auditor questions
- SOC 2 in Australia
- SOC 2 for BPO and shared services
- SOC 2 for fintech and payments
- SOC 2 for healthcare IT and health BPO
- SOC 2 for HR, payroll and staffing
- SOC 2 for managed service providers and data centres
- SOC 2 for SaaS and technology
- SOC 2 Type 1 vs Type 2
- SOC 2 in the UAE and GCC
- SOC 2 vendor management and subservice organisations
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan a SOC 2 programme around your client portal and engagement teams.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice