Subcontracting SOC 2 work to CPA firms

You can subcontract to a CPA firm and you can take referrals from one. What you cannot do is both on the same client, and the rule that says so is the reason this market exists.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Independence is the shape of this market. A CPA firm issuing a SOC 2 opinion cannot have designed or implemented the controls it is opining on, which is why readiness is a separate business. That leaves three workable arrangements between a consultancy and a CPA firm, and one that looks workable and is not. Subcontracted readiness delivery through a firm typically pays $900 to $1,600 CAD a day against a $1,800 to $3,000 CAD client-facing rate. You trade roughly 40 percent of the rate for not having to sell.

3 Arrangements that survive an independence review

$900 to $1,600 Subcontracted day rate, CAD

Never Both prepare and audit the same client

Which arrangements actually work?

Consultancy and CPA firm arrangements, tested against independence
Arrangement	Who holds the client	Allowed?	What to watch
They audit, you do readiness, separate contracts	Split	Yes, and it is the standard model	Do not let the client think you are one team
They refer readiness to you before engaging as auditor	You, then them	Yes	No fee split back to the audit firm
You subcontract readiness delivery to a firm that is not the auditor	You	Yes	Your client contract governs, and you carry the liability
You deliver readiness under a CPA firm's brand, and a different firm audits	The CPA firm	Yes	Their independence, their risk review, their rate
You deliver readiness under a CPA firm's brand and that firm audits	The CPA firm	No	This is the one that looks fine and is not
Referral fee paid by you to the audit firm that sent the client	Split	No	A financial interest in your engagement is exactly what independence prohibits
Joint marketing implying an end-to-end service	Ambiguous	Effectively no	Even where the contracts are clean, the appearance is what gets challenged

The distinction that matters is between the firm that signs the opinion and any other CPA firm. Working with CPA firms is normal. Working with the CPA firm that will audit that specific client, on that client's controls, is not, however the paperwork is arranged.

The rule is theirs to enforce, and the cost is yours

Independence obligations sit on the audit firm, not on you, and that makes your risk higher rather than lower. If an arrangement is challenged, the firm protects its licence by ending the relationship with you. You lose a channel, they lose a supplier. Assume you hold the downside.

What does subcontracting pay?

Rate comparison, Canadian SOC 2 readiness delivery, 2026
Model	Day rate to you (CAD)	Utilisation you can expect	Who carries scope risk
Direct client, your brand, fixed fee	$1,800 to $3,000 effective	40 to 60 percent	You
Subcontracted to a CPA firm's advisory arm	$900 to $1,600	60 to 85 percent when it flows	Them
Subcontracted to another consultancy	$1,000 to $1,700	Lumpy	Them
White-label under a platform partner	$800 to $1,400	Variable, often low	Shared, badly
The trade	Roughly 40 percent of the rate for utilisation you did not have to sell for.

Run the arithmetic on effective annual revenue rather than on rate. A practitioner billing $2,400 CAD a day at 45 percent utilisation earns less than one billing $1,300 CAD at 75 percent, and the second spends no evenings selling. That is the case for subcontracting, and it is a strong one in your first two years.

The case against is about who owns the relationship. Every subcontracted engagement builds the CPA firm's client list and not yours, you usually sign a non-solicit, and the day the flow stops you have no pipeline. Treat subcontracting as revenue that funds the channels on getting readiness work rather than as the business itself.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

How do you actually work with an audit firm's staff?

Ask for the request list format they use before the engagement starts, and organize the client's evidence to match it. Handing over evidence in your own taxonomy creates a translation step somebody has to pay for.
Produce populations from saved queries, not from spreadsheets somebody maintained. The first question in fieldwork is always whether the population is complete, and it is where readiness work is judged.
Write the system description in the client's voice and have the client sign it. One obviously written by a consultant invites questions about who runs the controls.
Hand over a control matrix mapping each criterion to the control, the owner and the artifact location. Two pages, and it is the single artifact auditors ask for by name after they have seen one.
Stay out of the opinion conversation entirely. When the client asks you whether something will pass, tell them what the evidence shows and let the auditor conclude.
Debrief after the report is issued and ask what cost their team time. That answer is what earns the next referral.

What has to be in the subcontract?

0 of 0 done ·

Named end client, and a warranty from the prime that it is not auditing that client
Deliverables defined as artifacts rather than as outcomes. You cannot warrant that a client passes an audit
Rate, hours cap and what happens when the estimate is exceeded, in writing before the first day
Payment terms tied to your invoice date and not to the prime being paid by the client
Liability capped at fees paid, with a carve-out you can actually live with for confidentiality
Non-solicit limited in time and scope to the specific clients you worked on, not to their whole client base
Right to say you did the work, at least in general terms, once the engagement closes
Ownership of your own templates and methodology, so a work-for-hire clause does not take your policy set
Confidentiality terms that let you meet your own obligations, including any breach record you must keep under PIPEDA

The template ownership clause is the one people sign without reading. A standard work-for-hire term hands the prime everything you produced on the engagement. If your policy set arrives as a deliverable, you have given away the asset that makes your next engagement profitable.

Can a CPA firm do both readiness and the audit?

No, not for the same client. Independence rules prohibit auditing controls the firm designed or implemented. Some large firms deliver readiness through a separate practice and then decline the audit, or deliver the audit and refer readiness out, but no firm can do both on one engagement.

Do I need to be a CPA to subcontract to a CPA firm?

No. Readiness delivery is unregulated consulting, and firms routinely subcontract it to engineers and security practitioners. What you cannot do is perform any part of the attestation work or hold yourself out as issuing an opinion.

Can I pay a referral fee to an audit firm?

Not for a client that firm will audit. A financial interest in your engagement is the clearest form of the thing independence rules exist to prevent. Referral fees between consultancies, or from you to a firm that will not be the auditor, are ordinary commercial arrangements.

Is white-labelling under a platform partner worth it?

Rarely at the rates offered, and the scope risk is usually shared in a way that means you absorb it. It is worth doing as filler between engagements and poor as a primary channel, because the client belongs to the platform and the work is priced against the platform's promise rather than the client's reality.

What insurance do I need to subcontract?

Professional liability at whatever limit the prime requires, commonly $2,000,000 CAD, and commercial general liability. Some CPA firms also require cyber liability now, since you will be handling their client's evidence. Get the requirement in writing before you quote, because the premium is a real cost against a subcontracted rate.

List your firm

Direct work is what makes subcontracting a choice rather than a dependency. A claimed listing is free.

List your firm

Where to go from here

Can one firm do readiness and the audit?. The independence rule this arrangement is designed around.
How to get SOC 2 readiness work. Where readiness work comes from if you are the firm being subcontracted.
Packaging a SOC 2 readiness offer. How to package the work so the arrangement is legible to the client.
Writing a SOC 2 readiness proposal. What the proposal has to say about who does what.