Outsourcing Standard ISAE 3402 (IDW PS 951) – Trust through audited business processes
As part of their outsourcing and digitalisation strategy, companies are outsourcing business processes and operational functions in order to streamline organisational structures, save costs and strengthen their international competitiveness.
Typical ISAE 3402 examples of classic outsourcing are outsourced services in the following areas:
- ERP hosting and application management service (AMS)
- Data centre operation
- Cloud services
- SaaS
- Logistics and warehouse management
- Managed payroll services or
- BPO billing processes for energy suppliers
We offer audits in accordance with ISAE 3402 and IDW PS 951 and assess the integrity and effectiveness of internal control systems based on our many years of experience in the customised development of compliance certificates and IT audits in the international regulatory environment.
Two certification variants are possible for each maturity level of the process controls:
- Type 1 assesses the adequacy (suitability), the control design (design) and the implementation of internal controls as at a reporting date (e.g. time-related establishment as at 30 June).
- Type 2 additionally confirms the effectiveness over a certain period of time, which usually corresponds to the customer's financial year (e.g. 1 January to 31 December; but at least six months).
If a Type 2 certificate is available, this is sufficient for the customer's auditor as proof of the audit and documentation; this means that an individual on-site audit is not necessary.
We use our expertise to help you consolidate your position in the market.
We advise you:
We offer you our modular services for all-round support:
- Module 1: Outsourcing health check & GAP analysis
- Module 2: Coaching and counselling for ICS set-up
- Module 3: Certification & attestation
- Module 4: Optimisation of process and system controls
Our consulting services are intended to lead pragmatically to solutions that are commercially appropriate, customised to the company, technically adequate, proper and in compliance with the applicable normative requirements (compliance by design – for processes and technologies).
Want to learn more?
Our services focus on the analysis, development, certification and optimisation of internal control systems (ICS) for service providers or shared service centres.
The ISAE 3402 certificate serves as recognised proof of the correctness of the service provider’s services, and is regarded as a quality criterion and quality feature differentiating them from competitors. An ISAE 3402 audit is based on established management systems and controls and ensures acceptance by auditors when auditing the annual financial statements of outsourcing companies.
We support you in setting up certification-ready control frameworks or certify their design and implementation (Type 1) and effectiveness (Type 2) for you with a uniform report recognised by all auditors in accordance with the established audit standards ISAE 3402 and IDW PS 951. Reporting can be in English or German, depending on the user group.
Further information on the project process and our modular support services can be found here:
ISAE 3402 Insights
