Technology Risk

The Third-Party Risk Assurance services enable service providers to provide trusted communications focused on internal controls to customers (and their external auditors), investors, management, regulators and other stakeholders. These services efficiently address service provider’s customer needs for trusted risk-based information. This will help organisations (service providers) demonstrate their controls related to data security, availability, processing integrity, confidentiality, and privacy. The products of Third-Party Risk Assurance services are System and Organisation Controls (SOC) reports. There are various types of SOC reports that EY can prepare for service providers, which include: 

• SOC 1 -  helps service providers that operate information systems and provide business process services supporting financial reporting, build trust and confidence in their delivery processes and controls through a report they can deliver to their customers and customer’s external auditors.
  
  
• SOC 2/3 - helps service providers meet the needs of a broad range of users that require information and assurance about the controls at the service provider that affect the security, privacy, confidentiality, availability and processing integrity of service provider’s systems. It is particularly relevant for technology and cloud computing service providers that handle sensitive data.
  
  
• SOC for Cyber - helps service providers meet the needs of a broad range of users that require information and assurance about a service provider’s enterprise-wide cybersecurity risk management program.
  
  
• SOC for Supply Chain - helps service providers meet the needs of stakeholders that require information and assurance about a service provider’s system and controls for producing, manufacturing, or distributing goods to better understand the risks in their supply chains.
  
  
• SOC for Regulatory Compliance - helps service providers meet the needs of a broad range of users that require information and assurance that the services providers meet regulatory requirements such as Australia Prudential Regulation Authority (APRA) CPS standards, Foreign Investment Review Board (FIRB) Conditions, Victorian Protective Data Security Standard (VPDSS), Information Security Manual (ISM), Privacy Act, etc.

EY teams also provide pre-assessment services for a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report).

Agreed Upon Procedures (AUP) services help service providers communicate independent results of controls testing or other procedures agreed upon between the service provider and recipients of the report (service provider’s customer or regulator). AUP engagements allow service providers to communicate independent factual findings on control testing or other procedures to recipients of the AUP report. EY teams present and report on a set of procedures that service providers and the specified third-party report users agree to, and the related findings resulting from the procedures.

A system and process assessment includes an assessment of internal control as part of an upgrade or an implementation of an ERP (e.g., SAP S/4HANA), an application, or a process. These services provide an independent assessment of an entity’s current state or a documented future state internal control to provide leading practice recommendations for management’s consideration. A system or a process upgrade or an implementation assessment helps the entity to:

• Obtain confidence that internal control considerations are adequately addressed.
  
• Understand complex business processes.
  
• Identify new risks and control gaps introduced by changes to process or technology and provide remediation recommendations based on leading practices.
  
• Enable the entity to take advantage of new capabilities that allow better leverage of investment in new process or technology, including opportunities for process automation and improvement, and GRC integration, reporting, and continuous control monitoring.

A pre-assessment of a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report), helps the entity to:

• Understand how to apply the evaluation criteria to the subject matter 
  
• Understand the disclosure requirements for the subject matter information (e.g., management’s description for a SOC report)
  
• Understand procedures performed to assess the subject matter information and/or controls

In addition, EY can assist with the following related services which include:

Process Risk and Controls Optimisation

• Assess and optimise existing processes to identify inefficiencies and areas for improvement.
• Implement leading practices to enhance process efficiency and effectiveness.
  
• Integrate process automation and improvement opportunities to streamline operations.
  
• Provide recommendations for continuous control monitoring and reporting to ensure ongoing compliance and risk management.

Supporting Clients in Upgrading Controls for Internal Controls over Financial Reporting Regulatory Compliance (e.g. SOX, UK Internal Controls and Audit Reform regulations)

• Conduct a pre-assessment of draft subject matter such as a system description prior to the performance of a limited or reasonable assurance engagement (e.g., SOC report) to help the entity:   
  • Understand how to apply the evaluation criteria to the subject matter.
  • Understand the disclosure requirements for the subject matter information (e.g., management’s description for a SOC report).
  • Understand procedures performed to assess the subject matter information and/or controls4.
  • Provide guidance on upgrading internal controls to meet SOX compliance requirements.
  • Offer recommendations for remediation of control gaps and implementation of best practices to ensure compliance with SOX regulations.

Cybersecurity and Regulatory Assurance services help entities better manage cybersecurity risks and prepare for and report on their regulatory obligations.

With the increasing sophistication of cyberattacks and the adoption of new technologies (e.g. AI), the potential to significantly impair an organisation’s reputation, financial position and ongoing business operations is becoming more likely. In response, state and federal government compliance obligations are increasing across all sectors, resulting in additional effort and resources to satisfy these requirements. Examples include:

• Security of Critical Infrastructure Act
• Privacy Act
• VPDSS

EY can assist organisations to more sustainably and efficiently manage their cybersecurity risks and regulatory and sector-specific compliance requirements with services such as:

• Cyber Framework Assessments (CPA) and Benchmarking (NIST, ISO, COBIT, Essential 8)
• Technical Vulnerability Assessments (e.g. Red Team and Purple Team assessments)
• Cyberwise – using our proprietary tools, assist in identifying information related to the online presence of our clients that could be used by threat actors to target an organisation (e.g. credential management, patch management and domain management).
• Resilience assessments (e.g. DRP and BCP assessments, Incident Response simulations)
• AI Regulations
• Data and IT controls in ESG reporting