Frazier & Deeter

Who is Frazier & Deeter?

Frazier & Deeter is a Top 50 US accounting firm founded in 1981 and led by Managing Partner & CEO Jeremy Jones. With 600–1,000 professionals across 14 offices in three countries, FD positions itself as offering large-firm compliance depth without Big Four pricing.

General Atlantic made a strategic growth investment in the firm in April 2025, with PSP Capital Partners and Aksia also participating. The firm is investing in M&A, talent, and technology.

FD acquired Arch + Tower (consulting/CX, 2020) and Rosen, Sapperstein & Friedlander (Mid-Atlantic CPA firm, Nov 2025). It ranked #41 by INSIDE Public Accounting (2025) and #44 on Accounting Today’s Top 100.

What is Frazier & Deeter’s SOC curriculum?

FD says its SOC practice is led by peer reviewers along with a co-author of the AICPA’s official SOC for Service Organizations curriculum, so someone who helped write that curriculum leads client engagements rather than only teaching it.

FD holds AICPA SOC Specialized Service Provider status, with dual-standard reporting under both AICPA Attestation Standards and ISAEs for international clients.

How deep is Frazier & Deeter’s HITRUST bench?

Andrew Hicks, Partner and National HITRUST Practice Leader, came to FD from Coalfire where he built their national HITRUST practice. At FD he has:

• Managed 300+ HITRUST engagements, per FD
• Served on multiple HITRUST Assessor, Quality, and Third-Party Risk Management Councils
• Led FD’s HITRUST practice to cover the full CSF: r2, i1, and e1 validated assessments

Can Frazier & Deeter combine frameworks on one program?

Yes. The Process, Risk & Governance practice covers SOC, IT audit, SOX, HIPAA, PCI, CMMC, FedRAMP, ISO, and cyber under one roof. A published payments-tech case study describes one evidence cycle across overlapping controls.

• SOC 1 / SOC 2 / SOC 3 attestation
• IT audit and internal audit
• SOX
• HIPAA
• PCI DSS
• CMMC and FedRAMP
• ISO
• cyber services

FD describes a consolidated approach that merges overlapping controls from SOC 2, PCI, HIPAA, and HITRUST into a single evidence-collection cycle. A published case study describes this for a global payments technology company.

For companies facing multi-standard audit burdens, one evidence set mapped across frameworks can cut duplicate fieldwork when the same control satisfies SOC 2 and ISO requirements.

Who is Frazier & Deeter a good fit for?

Frazier & Deeter fits fintech, payments, healthcare, and government-contractor buyers that want SOC 2 bundled with PCI, HIPAA, HITRUST, CMMC, or FedRAMP under one PRG team. It is not the cheapest first Type I boutique.

Best Fit For:

• FinTech and payments companies managing overlapping SOC 2 + PCI + HIPAA + HITRUST requirements under one engagement team
• Government contractors requiring CMMC and FedRAMP readiness alongside SOC 2
• Healthcare and higher-education organizations pursuing HITRUST certification
• Companies with international operations needing dual AICPA/ISAE reporting
• PE-backed growth companies that want a firm investing in scale, talent, and technology
• Middle-market companies that need large-firm depth without Big Four pricing

Not Ideal For:

• Early-stage startups needing only a basic SOC 2 Type I at the lowest possible cost
• Companies not prioritizing proper development of controls and processes

How is Frazier & Deeter positioned in the market?

Rankings & Awards:

• Ranked #41 by INSIDE Public Accounting Top 100 (2025)
• Ranked #44 on Accounting Today’s Top 100 Firms
• Named to USA TODAY’s America’s Most Recommended Tax & Accounting Firms 2026
• Top 50 US firm for five consecutive years
• Best of the Best, Best Firm to Work For, Best Firm for Women in Leadership, and Top Firm for Equity Leadership

Financial Backing:

• General Atlantic (lead investor, April 2025)
• PSP Capital Partners and Aksia also participating
• Actively pursuing M&A to expand service lines and geography

How much does a Frazier & Deeter SOC 2 audit cost?

Frazier & Deeter does not publish a public rate card. Directory estimates are $15,000–$35,000 Type I and $25,000–$75,000 Type II, with multi-framework bundles priced on combined scope.

• SOC 2 Type I: $15,000 – $35,000
• SOC 2 Type II: $25,000 – $75,000
• Multi-framework bundles (SOC 2 + PCI + HITRUST): priced on combined scope

Timeline:

• Type I: 4–8 weeks from kickoff to report delivery
• Type II Observation Period: 3–12 months (client choice)
• Report Delivery: 4–6 weeks post-fieldwork
• Total Type II: 4–14 months depending on observation window

FD describes its engagements as partner-led, with dedicated teams and direct partner access throughout the audit lifecycle. The firm has 63 partners, which FD says gives mid-market clients senior-level attention.

When should a buyer shortlist Frazier & Deeter?

Frazier & Deeter suits buyers who want compliance depth at scale without Big Four pricing. For companies with overlapping frameworks, particularly SOC 2 + HITRUST, SOC 2 + PCI, or CMMC + FedRAMP combinations, FD’s consolidated model and its SOC and HITRUST benches are the main reasons to shortlist it.

If your compliance program includes multiple frameworks and you want senior-level attention without paying Big Four rates, FD is worth a place on the shortlist.