Outsourcing standard ISAE 3402 (IDW PS 951)

In a brief review and joint evaluation, an initial status quo on the current level of compliance maturity is drawn up. For this purpose we will take a look at existing process descriptions, guidelines and documentation.

By means of interviews, the existing service processes are examined with regard to the establishment of internal controls and initial potential for improvement is identified (GAP analysis).

Our aim is to further secure your services and thus increase the effectiveness and efficiency of internal processes. To this end, together with ISAE employees with many years of experience, we will support you in active audit preparation and ensure the sustainable development and successful implementation of certifications.

Our sector-oriented and established sample controls cover the requirements of the current auditing standards and serve as a starting point for our health check.

As a project manager (PMO function), we are happy to help you implement the individual audit phases, ensure smooth and timely ISAE report delivery and minimise your internal workload.

A practical compliance management system can only be implemented if the risks that are relevant to the company have been considered.

During interview appointments we will identify the responsible control owners and define suitable control objectives with associated controls to ensure that processes are implemented in practice. Together with you, we will create an individualised risk control matrix (RCM), which will also form the basis for future certification.

When setting up the appropriate internal control system (ICS), we will pay attention both to compliance with regulatory requirements and to the requirements of clients and their auditors, including

• Ensuring the effectiveness of business activities
• Regularity and reliability of financial accounting
• Compliance with relevant internal and external regulations (compliance)

Existing control frameworks (e.g. sub-areas implemented according to ISO 27001 or internal risk control matrices) can be used to set up an ICS that is to be certified in order to reduce internal and external costs.
 
As a preliminary stage of an effectiveness review (type 2, period-related), a "pre-audit" as an adequacy review (type 1, reporting date-related) is appropriate. This involves getting to know the process of an outsourcing certification in advance by all those responsible and practising the necessary requirements. We will identify suggestions for improvement, point out concrete measures, check these subsequently and thus ensure the necessary level of maturity for certification.

We will confirm the control effectiveness for an individual scope of audit specified by you according to accepted outsourcing audit standards (e.g. ISAE 3402 or IDW PS 951) and issue a corresponding certificate for a predefined period of time. This certificate serves as an official, central audit certificate for the services provided (e.g. managed services or cloud services) and thus replaces a large number of audits by different clients and their auditors.

In addition to such "standard reporting", we will also support you in creating individual certificates for premium clients. To this end client-specific services and their process controls are additionally audited as part of our main audit and individually certified in a separate report. Our multi-client approach serves as a basis.

The cost of such a premium certification is usually charged to the respective clients on a pro rata basis, thus shifting the total cost of the ISAE basic audit to the service provider.

Further added values of a central ISAE outsourcing certification are:

• Certification as a quality criterion and differentiation from competitors (sales-oriented use and proof of quality)
• Use and decision criteria for private or public tenders
• Promotion of the service provider's reputation through insight into processes and their external evaluation ("CIO/CFO business card")
• Reduction of audit work by avoiding audit tourism and reducing the workload of those responsible for the process


In addition, we are available to you and the auditors of your clients at any time and free of charge for any questions (including those relating to our reporting, execution of the audit, explanations of the results and scope coordination) within the context of our assignment.

 

Due to our many years of project experience in successful initial certifications, we are specialists in the company-specific establishment of optimal process and system controls.

With our expertise we will support you in the further improvement of your implemented processes and their monitoring. We will continuously check whether control procedures can be further harmonised or automated. This can be achieved, for example, by summarising them in the form of high-level controls or by introducing suitable compliance management tools.

At the same time, we will give concrete advice on how to simplify and optimise control activities and the documentation thereof in order to reduce the daily workload of those responsible for the process and minimise internal administrative work.


Corporate governance ensures good corporate management and monitoring. We will show how the audited ICS can be integrated into existing compliance management systems (CMS) or how they can be set up and formally integrated as a separate sub-area. Common sub-areas are anti-corruption, taxes, data protection or information security.

For example, an IT ICS certified according to ISAE 3402 (general IT controls for   audits of annual financial statements, GITC) serves as the basis for further compliance management confirmation of information security according to ISAE 3000. Audit evidence, interviews and results already provided in the ISAE 3402 audit can be used for the audit of information security so that double audits and unnecessary interviews are avoided for those responsible for the process; cost saving potentials are the result.