When you hire an audit and assurance firm, you're trusting them with sensitive financial data, regulatory compliance, and your organization's reputation—which means understanding what insurance and liability protections they carry is critical. A provider without proper coverage can leave you exposed if errors occur, audits fail legal scrutiny, or data breaches happen. Here's what you need to know before signing a contract.
Professional Liability Insurance: The Baseline
Every reputable audit and assurance firm should carry professional liability insurance (also called errors and omissions or E&O insurance). This covers financial losses if the provider's negligence, mistakes, or failure to follow auditing standards damages your business.
For audit firms, typical professional liability coverage ranges from $1 million to $10 million in the U.S., depending on firm size and client base. Smaller firms serving mid-market clients often carry $2–5 million; national firms handling Fortune 500 clients typically maintain $10 million or higher. Ask your potential provider directly: What's their coverage limit? When does the policy renew? Does it include tail coverage (extended reporting period after the policy ends)?
This matters because audit failures can be expensive. If a firm misses material fraud or compliance breaches during their audit, you could face regulatory penalties, shareholder litigation, or restatement costs running into millions.
Data Security and Cyber Liability
Audit work involves accessing bank statements, tax records, vendor contracts, and payroll data. Cyber liability insurance protects you if the firm experiences a data breach exposing your sensitive information.
Look for providers with:
- Cyber liability coverage of at least $500,000–$2 million for data breach response, notification costs, and regulatory fines
- Network security protocols documented in writing (encryption standards, access controls, multi-factor authentication)
- SSAE 18 SOC 2 Type II certification or equivalent, proving they've had third-party audits of their own security practices
- Cyber insurance riders that explicitly cover client data, not just their internal systems
Ransomware and phishing attacks increasingly target professional service firms because they hold high-value client information. A provider without cyber liability is betting you'll absorb the cost of a breach—which can exceed $1 million for notification, credit monitoring, and litigation.
Liability Caps and Contractual Protections
Before engaging any audit and assurance provider, review the limitation of liability clause in their engagement letter. This defines the maximum they'll pay if something goes wrong.
Typical limitations include:
- Cap at contract value: Provider limits liability to the fee you paid them (e.g., $50,000 audit fee = $50,000 maximum liability)
- Cap at insurance limit: Liability maxes out at their professional liability policy limit
- Proportionate liability: You share blame if you failed to disclose information or ignored their recommendations
These caps protect the provider but can leave you underprotected. If a $100,000 audit misses $2 million in fraudulent expenses, a $50,000 liability cap barely covers your loss. Negotiate: Can they increase the cap for higher-risk work? Will they accept broader liability for gross negligence or willful misconduct?
Also confirm whether their insurance covers contractual liability (some policies don't automatically cover promises made in engagement letters).
Specific Coverage for Your Industry
If you operate in a regulated sector—healthcare, financial services, nonprofits, publicly traded companies—your audit firm needs insurance tailored to those risks.
- Public company audits require PCAOB registration and higher coverage thresholds
- Healthcare audits often need coverage for HIPAA compliance failures
- Nonprofit audits may require coverage for grant compliance and Form 990 accuracy
- Financial institution audits typically demand coverage aligned with FDIC or banking regulator expectations
Ask: Does your firm have experience auditing organizations in my industry? Is your liability coverage calibrated to those specific risks? Do you carry any specialty endorsements?
Verifying Coverage Before You Sign
Don't take a firm's word for it. Request a certificate of insurance before engagement—it's a one-page document showing policy numbers, coverage amounts, and expiration dates. Confirm the certificate lists you or your organization as an "additional insured" where applicable.
Check that coverage is active and current. Policies expire; claims-made policies only cover incidents reported during the active term.
If you're comparing multiple audit and assurance providers, Mercoly helps you find and evaluate trusted firms in one place, making it easier to assess their qualifications and insurance credentials side by side.
Frequently Asked Questions
Q: What should I do if my audit firm doesn't have professional liability insurance? Don't engage them—this is a dealbreaker. Firms without E&O insurance are betting they won't make mistakes, which is statistically unlikely and leaves you unprotected.
Q: Can I verify a firm's insurance independently, or must I trust their certificate? You can request the insurer contact information and verify the policy directly, though most firms will provide certificates. Independent verification is wise for high-stakes audits.
Q: Does an auditor's liability insurance cover my losses if I'm sued by a regulator? Professional liability typically covers your losses due to the auditor's negligence, but regulatory fines or penalties you incurred independently are generally excluded—review the policy language with your insurance broker.
Use Mercoly to compare audit and assurance providers and their coverage credentials all in one place.