SOC 2 for Professional Services Firms: When Clients Start Asking for It

A professional services firm needs SOC 2 when a client makes the report a condition of the contract. Before that, a well-answered security questionnaire, a written security program, and your vendors' SOC 2 reports usually get you through the review.

The request rarely comes from the partner you work with. It comes from procurement. A client's vendor risk team sends a 200-question spreadsheet, and question 14 asks for your most recent SOC 2 Type II report, and suddenly a 40-person consultancy is being measured like a software company (the IT side of that pressure is on our page about IT services for professional services firms).

Key Takeaways

• SOC 2 is a CPA firm's report on your security controls. It isn't a certification.
• Clients ask for it through vendor questionnaires, RFPs, and contract renewals.
• Read the exact wording first. "SOC 2 or equivalent" leaves room. "SOC 2 Type II required" doesn't.
• Microsoft 365 and most practice software vendors already have SOC 2 reports you can point to.
• A first Type II takes 6 to 15 months, so start before the renewal date.

What is SOC 2, and why do clients ask professional services firms for it?

SOC 2 is an attestation report from an independent CPA firm on whether your controls protect the systems that hold client data. Clients ask law, accounting, and consulting firms for it because those firms hold the same confidential data a software vendor does, and their vendor risk teams use one checklist for both.

The AICPA writes the standard. Its SOC suite overview describes these reports as assurance CPAs provide "in connection with system-level controls of a service organization." You're the service organization. Your client is the user entity, and it wants proof before it uploads its merger files, payroll data, or litigation documents to your systems.

Type I says your controls were designed correctly on one date. Type II says they actually ran over a period, usually 3 to 12 months. Enterprise buyers mostly want Type II. Plan for it. Our SOC 2 Type I vs Type II guide covers the difference in depth.

Law firms feel this first. BDO, itself a CPA firm that performs these audits, wrote that "attestation reports become a common prerequisite for law firms to participate in Requests for Proposals or as clients begin to include them in their contracts." Accounting and consulting firms are a step behind. Not far.

Where does the SOC 2 request usually show up?

It shows up in paperwork, almost never in conversation. Watch for these:

• A vendor security questionnaire from a new client's third-party risk team.
• An RFP with a "security and compliance" section that asks you to attach reports.
• The renewal of a master services agreement, where the client's legal team has added a data security exhibit.
• Outside counsel guidelines. Corporate legal departments send these to their law firms, and the security section keeps getting longer.
• A client's own auditor. If your work touches their financial reporting, their auditor may ask for your controls evidence too.
• An existing client that never asked before and now does, usually after it had an incident or hired a new CISO.

That last one catches firms flat-footed. The relationship is 8 years old, the partner is friendly, and the new security officer still wants the report by Q2.

Do you actually need a SOC 2 report yet?

You need one when a client you can't afford to lose makes it a contract requirement. If the request says "SOC 2 or equivalent," or arrives as a questionnaire question rather than a clause, a strong written answer and supporting evidence usually close the review without an audit.

Linford & Co., an audit firm, asks on its blog whether your customers are asking for a SOC report. "If they are, you will need to get one or be prepared to lose their business. If they are not, you do not need one."

So read the wording. Then do the math on the revenue behind it.

Skip the audit if no client has put it in writing. An audit nobody asked for buys a report nobody reads, and that money does more good spent on the controls themselves.

What can you send a client before you have a SOC 2?

Send evidence that your controls exist and that the platforms holding their data are already audited. That usually means a completed questionnaire, a short security program summary, recent test results, and the SOC 2 reports of Microsoft 365 and your practice software vendors.

Most of your client data doesn't sit on a server in your office anymore. It sits in Microsoft 365, NetDocuments, iManage, Box, or CCH Axcess, and the larger platforms publish SOC 2 reports their customers can request. Microsoft publishes its reports on the Service Trust Portal, and its SOC 2 compliance page notes that "you must have an existing subscription or free trial account in Office 365" to download them, "in accordance with AICPA requirements." You have the subscription. Download the report.

There's a catch, and a sharp client reviewer will know it. Microsoft's report covers Microsoft's controls. Your settings, who has admin rights, whether MFA (a second login step, usually a phone prompt) is enforced, how fast you remove a departing associate's access, are all yours. Auditors call those complementary user entity controls. In plain English, it's the part of the job Microsoft expects the customer to do.

A packet that answers most reviews looks like this:

• The completed questionnaire, answered by someone who knows your environment, not copied from a template.
• A 2-page summary of your written information security program.
• Your MFA enrollment rate, backup test date, and last penetration test date.
• The SOC 2 reports of your main platforms.
• Your incident response plan's table of contents. Not the whole plan.

If you need help building that program, our guide to an information security compliance program lays out the documents.

How long does SOC 2 take for a professional services firm, and what does it cost?

A Type I report takes a few weeks to 3 months once your controls are in place, with audit fees of $7,500 to $60,000. A Type II runs 6 to 15 months end to end, including a 3 to 12 month observation window, with audit fees of $12,000 to $100,000. Readiness work comes on top.

Those ranges come from our Type I vs Type II guide, and our IT compliance costs breakdown prices the readiness and tooling side. A 30-person firm with a narrow scope sits near the bottom of each range. Firms that add Confidentiality and Privacy criteria, multiple offices, or a client portal they built themselves move up.

Work backward from the date in the contract.

A Type I report is a reasonable thing to hand a client mid-way. It tells them the controls are designed. The Type II follows.

What does a SOC 2 scope look like for a law, accounting, or consulting firm?

A professional services scope usually covers the Security criteria, which every SOC 2 requires, plus Confidentiality, because protecting client information is the whole engagement. The systems in scope are the ones where client data actually lives, not the entire firm.

That list is shorter than people expect. For a typical firm it's laptops and phones, Microsoft 365, the document management system, file transfer or the client portal, and whoever has admin access to all of it. The marketing website stays out. So does the office Wi-Fi guest network.

Firm type changes the rest.

Law firms. The ethics rules already ask for vendor diligence. ABA Formal Opinion 477, later revised as 477R, says lawyers "must exercise reasonable efforts when using technology in communicating about client matters," and lists factors such as "reference checks and vendor credentials" when choosing vendors. A SOC 2 report answers that question for your own clients and for the firms that refer work to you. Our page on IT services for law firms covers the systems side.

CPA and tax practices. SOC 2 doesn't replace the law. The FTC Safeguards Rule requires a covered firm to "designate a Qualified Individual to implement and supervise your company's information security program," and says "your risk assessment must be written." You need that program whether or not a client ever asks for an audit report. Build it first, and the SOC 2 work gets much shorter.

Consulting, architecture, and engineering firms. Commercial clients in the US ask for SOC 2, European clients tend to want ISO 27001, and our SOC 2 vs ISO 27001 comparison covers when one report can do both jobs. Firms that touch Defense Department work answer to CMMC, a different framework entirely, covered on our CMMC compliance page.

Does a SOC 2 report make your firm secure?

No. The report covers the controls in scope, during the audit period, as the auditor tested them, and a firm can pass with a narrow scope while client data sits in a system nobody looked at. Phishing emails don't check the audit period.

Compliance isn't security. I'd put that on the wall of every firm going through its first audit, because the audit makes it very easy to confuse the two. The auditor tests what's in scope. The attacker doesn't read your scope.

IBM's 2026 Cost of a Data Breach Report puts the average breach at a professional services firm, which IBM defines as legal, accounting, and consulting, at $5.08M. That's above the $4.99M global average. A clean SOC 2 opinion doesn't lower that number. MFA everywhere, tested backups, fast offboarding, and someone watching alerts at 2 a.m. do.

Be careful about speed, too. The AICPA's SOC resource page says it refers "unlicensed firms and practitioners" to state boards of accountancy, and the AICPA's Journal of Accountancy ran an April 2026 piece on the risks of quick-turn SOC engagements. A report that shows up in 3 weeks with no real testing behind it can fail your client's review anyway. Ask who signs the opinion, and check that the firm is a licensed CPA firm.

At Consilien, compliance is a separate service from managed IT. A managed IT provider runs the controls day to day (the patching, the MFA rollout, the backups), and its tickets and reports become audit evidence. The SOC 2 program itself, meaning the policies, the risk assessment, the evidence collection, and the auditor relationship, is its own engagement. Our SOC 2 compliance services page describes it, and the wider compliance practice covers ISO 27001, CMMC, and PCI. What the IT side costs on its own is in our guide to managed IT cost for professional services firms.

If a client has just sent you the questionnaire and the deadline is real, bring the request and the contract date and speak to a professional services IT expert.