A referral program for compliance consultants working on SOC 2, ISO 27001 and CMMC

Why compliance work surfaces fit early

Compliance consultants are well placed to spot SourceX candidates because the evidence they collect already answers most of the fit questions: how many systems a company runs, what records each one holds, how long they are kept and who owns them. SourceX manages data licensing for companies, connecting businesses that hold proprietary operating records with the AI developers who license them, and a referral partner's only job is the introduction.

Think about what sits in your engagement folders. A SOC 2 system description and data flow diagrams. An ISO 27001 asset inventory, Statement of Applicability and retention controls. A CMMC system security plan with its scoping decisions. Vendor lists, access reviews, retention schedules and disposal records. Few outside advisers see a company's record-keeping that clearly, and fewer still see it across many clients each year.

Which compliance clients fit, by framework

The common thread is a company that created its own records over several years and labeled them well. Certifications themselves do not make a company qualify; they make the later rights and redaction work easier.

The evidence reuse test

Answer each question from documents you already hold. Do not ask the client for anything new, and never pass those documents to SourceX.

• Headcount: does the in-scope population or org chart show 50+ full-time employees at peak (contractors excluded)?
• System breadth: does the system inventory list many record-holding systems? Strong companies often run 10-15+.
• History: does the retention schedule keep operational records for years, including archived systems?
• Ownership: do the data flow diagrams show records the company generates itself, as opposed to data it processes for customers?
• Sponsor: do you have a working line to the executive who signs the management assertion, approves the ISMS or owns the security plan?

Three or more yeses, with headcount among them, justify a short conversation. The tech stack audit template adds a data asset section if you want a structured way to capture this for your own notes, and the network opportunity finder is a structured way to decide where in your client list to begin.

Disclosure and independence checks before you register

Your professional role decides what you may accept, so check it before the first introduction, not after.

If you work at a CPA firm, the AICPA Code of Professional Conduct is the starting point. Its Commissions and Referral Fees Rule (ET 1.520) says a member in public practice may not accept a commission for recommending a product or service to a client when the member or firm also performs an audit, review, certain compilations or an examination of prospective financial information for that client, and requires permitted commissions and referral fees to be disclosed to the client. The Contingent Fees Rule (ET 1.510) sits alongside it. State boards can be stricter than the AICPA Code, as the New Jersey Society of CPAs explains for its state.

In every case, disclose the referral relationship to the client in writing. This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

When to raise it in the compliance cycle

How the introduction works

1. Raise the topic with the executive sponsor and confirm they want to hear more.
2. Create your partner account, then either forward your referral link or complete the referral form with high-level fit details and nothing more.
3. The sponsor's application at sourcex.si/apply carries your code.
4. SourceX confirms fit: peak headcount, years of documented operations, how widely records are spread across systems, and rights to license them.
5. The company completes its own data inventory and agrees redaction and de-identification requirements before any work starts.
6. Once a price and terms are in place, AI labs and data buyers look at the opportunity, and the company signs only if the deal works for it.
7. The buyer receives records only when the agreement has been executed and the company has authorized delivery; then the company is paid.

The how it works page walks through the same sequence from the company's side.

What to say at the executive readout

How rewards work for compliance consultants

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward becomes payable only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.

Because it is paid out of SourceX's fee, nothing is deducted from what the client receives. Read the program terms for the current details. Security-focused advisers working as fractional security leaders may prefer the vCISO page, and broader business advisers will find their version on the management consultants page.

Clients to pass over

• The client's headcount never reached 50+ full-time employees at peak (contractors excluded).
• Its records mainly concern its customers' data, as at many hosting, payroll or outsourcing firms.
• Most of the valuable history sits inside a controlled-information, cardholder-data or health-data boundary.
• Retention rules have already cleared out the history, or it cannot be exported.
• The company has signed an AI-training license for these records before.
• Your own professional rules bar a reward for that client.

Next step

After your next readiness kickoff, run the evidence reuse test on the client and check your own rules. If both clear, register as a partner, disclose the relationship, and let the sponsor apply at sourcex.si/apply via your referral link.