ISAE 3402 / PS 951 / SSAE 18 (SSAE 16)

Outsourcing is an ongoing trend and companies want to place reliance on third-party providers – processes as well as controls – to deliver even critical services such as IT (SaaS, SaaP, SaaI), Finance and Accounting or Payroll. Consequently, outsourcing companies are looking for independent third-party assurance considering the services used to get sufficient comfort about the Internal Control System of the outsourcer, where applicable attributed by own internal controls, to result in a seamless and gapless Internal Control System.

The planning, execution, reporting and use of these kind of audits is supported by accepted and well-established auditing standards. Commonly known are the International Standard on Assurance Engagements ISAE 3402 along with its German adaption, the IDW PS 951 as well as the revised SSAE 18 (formerly known as SSAE 16 and SAS 70 before), a standard common in the US and for SEC registered companies.

Hiring an independent auditor to perform the System and Organization Control review allows the outsourcer to be subject to one internal control audit instead of multiple audits with differing focus or focus or interpretations of statutory or customer specific requirements.

After completion, the report is distributed to the outsourcer’s customers and their auditors electronically so that management and auditors can rely upon its opinion and findings. Management can traceably evidence its accountability of the implementation and maintenance of reliable processes and controls and (financial) auditors may subsequently limit or eliminate additional substantive audit procedures. An additional advantage for the outsourcer by being able to provide this acknowledged assurance report is to acquire additional customers and extend the business into markets where this certification is factual obligatory.

Grant Thornton Germany will staff these projects with experienced IT and industry professionals familiar not only with an efficient execution of the review but also in assisting the outsourcer it getting prepared for the review.

Our Serivces

• Perform SOC reviews of Type 1 (assessment of the Internal Control Sysstem design effectiveness) and Type 2 (additional assessment of the operating effectiveness of controls in the specified period)
• Assistance in the preparation for the audit, e.g. wording of the outsourcer’s description, hints on efficiency gains in e.g. control evidence
• Design and implementation of an Internal Control System (consulting service without formal assurance)