IT Assurance audits

There are different types of IT assurance reports. Ultimately, it is often the demand of the client (the user organisation) that determines which report is chosen. In other words, together with your client, you determine which type of assurance report should be delivered. What does the client (user organisation) ask for and what does the client want assurance on and for what purpose? An IT assurance statement can lead to better cooperation and more trust between service organisation and user organisation. We distinguish the following types of IT assurance reports:

ISAE 3402:

An ISAE 3402 statement is an independent assessment by an IT auditor of the reliability of financial and underlying processes outsourced to a service organisation. Organisations increasingly outsource processes to service organisations (outsourcing), making them dependent on the quality and control of these outsourced services and processes. The scope of ISAE 3402 is not limited to the control measures for the financial processes, but issues such as reliability of the primary process, information security, availability and integrity can also be included in an ISAE 3402 report.

ISAE 3000:

An ISAE 3000 statement is an independent assessment by an IT auditor of general non-financial management processes, including processes such as change management, incident management, service level management, security management, continuity management, software development and other processes belonging to the primary service. With an ISAE-3000 report, the client can demonstrate that the internal management processes are actually performed as described and provide assurance that it is adequately set up.

SOC 2:

To demonstrate as a service organisation that the processes outsourced to the service organisation are performed reliably, a Service Organisation Control standard (SOC 2) provides an independent opinion on security, availability, confidentiality, integrity and/or privacy. A SOC 2 Assurance contains the trust service criteria (objectives) (a generic US standards framework) which are divided into 5 categories: security, availability, confidentiality, integrity and/or privacy. SOC 2 provides a service organisation with an opportunity to provide customers with insight into the control measures and processes applicable to the service. In a SOC 2 audit, DigiTrust assesses the service organisation's management objectives and measures.