Your partner for all your assurance needs

Information technology and digitalisation touch everything and everyone. Their impact on our lives is increasing every day, both privately and professionally. Every organisation will need to embrace technology to guarantee continued success. At the same time, this continuous progress also creates ever-increasing competition, risks and compliance requirements.

Is the data within your own organisation and those of your customers adequately protected?
How do you know if measures have been implemented effectively and that you can respond appropriately in case of incidents?
Is the availability, integrity and confidentiality of your data assured?

These are just a few topical questions to which your customers, partners and regulators increasingly expect concrete answers. An assurance report offers your stakeholders the answers they need.

With an assurance report, you demonstrate that your operations and services comply with agreements and are in line with international standards and guidelines.

Which report suits your organisation?

The International Standard on Assurance Engagements (ISAE) 3000 is a general standard for assurance engagements that does not focus on historical financial information. It includes guidelines for conducting assurance engagements on a variety of topics, such as internal control, compliance and other non-financial information. The form of these reports is largely fixed but it is up to the organisation to determine which framework(s) and/or specific processes within the business or technological environment will be reported on.

The International Standard on Assurance Engagements (ISAE) 3402 is a globally recognised standard focussed on providing assurance over internal controls of service providers that may have a potential impact on their clients' financial figures and/or financial reporting. Service providers use this report to demonstrate the effectiveness of their internal controls to clients, client auditors and other stakeholders.

SOC2 and SOC3 reports are assurance reports issued on the basis of the System and Organisation Controls 2/3 (SOC2/3) standard. This gives customers and other stakeholders insights into a service organisation's control measures and security level. Service organisations include cloud service providers, data centres, Software as a Service (SaaS) companies and other service providers that are critical for processing and storing their customers' sensitive data.
During a SOC2 assessment, your service provider's compliance is checked against the Trust Services Criteria framework. This structure is very similar to the well-known ISO 27002 and COSO frameworks.
A SOC2 report is intended for your customers and stakeholders, such as auditors or your customers' security officers.
Would you like to share your SOC report with a wider audience, for example by posting it on your website? Then opt for SOC3 reporting.

Since the launch of GDPR in 2018, there has been a surge in customer queries regarding the use of privacy data and how service providers ensure compliance with these regulations. You can demonstrate compliance with relevant privacy regulations to your customers and stakeholders through SOC 2 reports, which include the Trust Service Criteria regarding Privacy, or a dedicated Privacy assurance report.

Businesses and governments are becoming increasingly aware of the need for robust cybersecurity risk management programmes. With a SOC for Cyber report, you can demonstrate that your organisation meets the applicable standards. SOC for Cyber differs from SOC 2 in two fundamental perspectives:

SOC for Cyber is applicable to all types of organisations and not limited to service organisations
SOC for Cyber compliance can be tested against the Trust Services Criteria framework but equally against other applicable standards and frameworks such as ISO 27002, NIST CSF or the ISF Standard of Good Practice for Information Security framework.

SOC for Cyber reports provide organisations with an established framework to demonstrate adherence to key elements of a Cybersecurity risk management system based on the following building blocks
- Nature of Business and Operations
- Nature of Information at Risk
- Factors that Have a Significant Effect on Inherent Cybersecurity Risks
- Cybersecurity Risk Governance Structure
- Cybersecurity Risk Assessment Process
- Monitoring of the Cybersecurity Risk Management Program
- Cybersecurity Control Processes

Want to dive deeper in the foundations of risk management?

Discover our Risk Blueprint video series

The International Standard on Assurance Engagements (ISAE) 3000 is a general standard for assurance engagements that does not focus on historical financial information. It includes guidelines for conducting assurance engagements on a variety of topics, such as internal control, compliance and other non-financial information. The form of these reports is largely fixed but it is up to the organisation to determine which framework(s) and/or specific processes within the business or technological environment will be reported on.

ISAE3402/SOC 1

SOC 2

SOC 2+

SOC 3

SOC for Cybersecurity

WHO IS THIS SOC FOR?

A Service Organisation (One that provides services to user entities)

;

Any Type of Organisation

;

REPORTS ON AN ORGANIZATION’S...

Financial Reporting

;

Security

;

Availability

;

Process Integrity

;

Confidentiality

;

Privacy

;

DISTRIBUTION

Restricted (Users)

Unrestricted (General Use)

;

Third Party Assurance

Your partner for all your assurance needs

How BDO can help

Professional guidance in third party assurance

Objective and honest sounding board

Trusted advisor in Third Party Assurance

Which report suits your organisation?

ISAE3000

ISAE 3402/SOC1

SOC2/SOC3

Privacy attestation

SOC for Cyber

Want to dive deeper in the foundations of risk management?

Publications

Get in touch with our Third Party Assurance experts