Technology Risk

System and Organization Controls Reporting and ISO Certification Services help organizations build trust and transparency through independent assurance over internal controls and management systems.

Through risk-based SOC reports and globally aligned ISO certifications, EY supports regulatory, customer and stakeholder confidence in an organization’s controls and compliance environment.

A system and process assessment includes an assessment of internal control as part of an upgrade or an implementation of an ERP (e.g., SAP S/4HANA), an application or a process. These services provide an independent assessment of an entity’s current state or a documented future state internal control to provide leading practice recommendations for management’s consideration. A system or a process upgrade or an implementation assessment helps the entity to:

• Obtain confidence that internal control considerations are adequately addressed.
• Understand complex business processes.
• Identify new risks and control gaps introduced by changes to process or technology and remediation recommendations based on leading practices.
• Enable the entity to take advantage of new capabilities that allow better leverage of investment in new process or technology, including opportunities for process automation and improvement, and GRC. integration, reporting and continuous control monitoring.

A pre-assessment of a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report), helps the entity to:

• Understand how to apply the evaluation criteria to the subject matter 
• Understand the disclosure requirements for the subject matter information (e.g., management’s description for a SOC report)
• Understand procedures performed to assess the subject matter information and/or controls

IT Compliance and Regulatory Assurance services help entities understand, prepare for, and report to address rapidly evolving laws, regulations and professional standards. These services help an entity more sustainably and efficiently address regulatory and sector-specific (e.g., Government, Healthcare, Financial Services) technology compliance requirements. Examples include helping entities comply with requirements related to:

• AI regulations (e.g., AI Act)
• Cybersecurity (e.g., Cyber Resilience Act, Cybersecurity Maturity Model Certification, Network and Information Security (NIS2) Directive)
• Data security (e.g., Data Act)
• Digital resilience (e.g., Digital Services Act, Digital Markets Act, Digital Operational Resilience Act)
• Sector-specific requirements (e.g., HITRUST, SWIFT, TISAX)
• Data and IT controls in ESG reporting