Technology Risk

The Third-Party Risk Assurance services enable service providers to provide trusted communications focused on internal controls to customers (and their external auditors), investors, management, regulators and other stakeholders. These services efficiently address service provider’s customer needs for trusted risk-based information. This will help organisations (service providers) demonstrate their controls related to data security, availability, processing integrity, confidentiality, and privacy. The product of Third-Party Risk Assurance services are Service Organization Control (SOC) reports. There are various types of SOC reports that EY can prepare for service providers, which include: 

• SOC 1 -  helps service providers that operate information systems and provide business process services supporting financial reporting, build trust and confidence in their delivery processes and controls through a report they can deliver to their customers and customer’s external auditors.
  
  
• SOC 2/3 - helps service providers meet the needs of a broad range of users that require information and assurance about the controls at the service provider that affect the security, privacy, confidentiality, availability and processing integrity of service provider’s systems. It is particularly relevant for technology and cloud computing service providers that handle sensitive data.
  
  
• SOC for Cyber - helps service providers meet the needs of a broad range of users that require information and assurance about a service provider’s enterprise-wide cybersecurity risk management program.
  
  
• SOC for Supply Chain - helps service providers meet the needs of stakeholders that require information and assurance about a service provider’s system and controls for producing, manufacturing, or distributing goods to better understand the risks in their supply chains.
  
  
• SOC for Regulatory Compliance - helps service providers meet the needs of a broad range of users that require information and assurance that the services providers meet regulatory requirements such as Australia Prudential Regulation Authority (APRA) CPS standards, Foreign Investment Review Board (FIRB) Conditions, Victorian Protective Data Security Standard (VPDSS), Information Security Manual (ISM), Privacy Act, etc.

EY teams also provide pre-assessment services for a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report).

Agreed Upon Procedures (AUP) services help service providers communicate independent results of controls testing or other procedures agreed upon between the service provider and recipients of the report (service provider’s customer or regulator). AUP engagements allow service providers to communicate independent factual findings on control testing or other procedures to recipients of the AUP report. EY teams present and report on a set of procedures that service providers and the specified third-party report users agree to, and the related findings resulting from the procedures.

The ISO Management System Certification, Implementation and Training services provide implementation and certification of a management system according to ISO standards and other established certification frameworks.

EY CertifyPoint B.V., an EY entity founded in 2002, is an accredited, independent, and impartial certification institute headquartered in the Netherlands. Through EY CertifyPoint, EY teams provide Lead Implementer and Lead Auditor courses, including certification of entity personnel for several ISO standards.

EY teams support entities in meeting their goals by improving the efficiency and effectiveness of their management systems. EY teams keep the business at the center, identifying areas of redundancy, bottlenecks and potential efficiency gains by means of a systematic and independent certification approach against a globally recognized standard.

The following standards are addressed:

• ISO 9001: Quality Management System
• ISO 14001: Environment Management System
• ISO/IEC 20000-1: IT Service Management System
• ISO 22301: Business Continuity Management System
• ISO/IEC 27001: Information Security Management System
• ISO/IEC 27017: Cloud Security Controls
• ISO/IEC 27018: Protection of Personally Identifiable Information in Cloud
• ISO/IEC 27701: Privacy Information Management System
• ISO 37001: Anti Bribery Management System
• ISO/IEC 42001: Artificial Intelligence Management System
• ISO 45001: Occupational Health and Safety Management System
• ISO 50001: Energy Management
• World Lottery Association (WLA) assessments
• CSA STAR certification
• NEN 7510-1: Health Information Security Management System
• Hébergeur de Données de Santé (HDS)
• Multi-Tier Cloud Security (MTCS - Singapore)
• GDPR assessment
• CISPE Code of Conduct accredited monitoring body
• Integrated approach with ISAE3402, SOC and other attestation reports, such as a combination of ISO/IEC 27001:2013 with ISAE3402

A system and process assessment includes an assessment of internal control as part of an upgrade or an implementation of an ERP (e.g., SAP S/4HANA), an application, or a process. These services provide an independent assessment of an entity’s current state or a documented future state internal control to provide leading practice recommendations for management’s consideration. A system or a process upgrade or an implementation assessment helps the entity to:

• Obtain confidence that internal control considerations are adequately addressed.
  
• Understand complex business processes.
  
• Identify new risks and control gaps introduced by changes to process or technology and provide remediation recommendations based on leading practices.
  
• Enable the entity to take advantage of new capabilities that allow better leverage of investment in new process or technology, including opportunities for process automation and improvement, and GRC integration, reporting, and continuous control monitoring.

A pre-assessment of a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report), helps the entity to:

• Understand how to apply the evaluation criteria to the subject matter 
  
• Understand the disclosure requirements for the subject matter information (e.g., management’s description for a SOC report)
  
• Understand procedures performed to assess the subject matter information and/or controls

In addition, EY can assist with the following related services which include:

Process Risk and Controls Optimization

• Assess and optimize existing processes to identify inefficiencies and areas for improvement.
  
• Implement leading practices to enhance process efficiency and effectiveness.
  
• Integrate process automation and improvement opportunities to streamline operations.
  
• Provide recommendations for continuous control monitoring and reporting to ensure ongoing compliance and risk management.

Supporting Clients in Upgrading Controls for Internal Controls over Financial Reporting Regulatory Compliance (e.g. SOX, UK Internal Controls and Audit Reform regulations)

• Conduct a pre-assessment of draft subject matter such as a system description prior to the performance of a limited or reasonable assurance engagement (e.g., SOC report) to help the entity:   
  • Understand how to apply the evaluation criteria to the subject matter.
  • Understand the disclosure requirements for the subject matter information (e.g., management’s description for a SOC report).
  • Understand procedures performed to assess the subject matter information and/or controls4.
  • Provide guidance on upgrading internal controls to meet SOX compliance requirements.
  • Offer recommendations for remediation of control gaps and implementation of best practices to ensure compliance with SOX regulations.

Cybersecurity and Regulatory Assurance services help entities better manage their cybersecurity risks and assist with preparing for and reporting their regulatory obligations.

With the increasing sophistication of cyberattacks and the adoption of new technologies (e.g. AI), the potential to significantly impair an organisation’s reputation, financial position and ongoing business operations is becoming more likely. In response, state and federal government compliance obligations are increasing across all sectors, resulting in additional effort and resources to satisfy these requirements. Examples include:

• Security of Critical Infrastructure Act
• Privacy Act
• VPDSS

EY can assist organisations to more sustainably and efficiently manage their cybersecurity risks and regulatory and sector-specific compliance requirements with services such as:

• Cyber Framework Assessments (CPA) and Benchmarking (NIST, ISO, COBIT, Essential 8)
• Technical Vulnerability Assessments (e.g. Red Team and Purple Team assessments)
• Cyberwise – using our proprietary tools, assist in identifying information related to the online presence of our clients that could be used by threat actors to target an organisation (e.g. credential management, patch management and domain management).
• Resilience assessments (e.g. DRP and BCP assessments, Incident Response simulations)
• AI Regulations
• Data and IT controls in ESG reporting