Technology Risk

The SOC reporting services enable entities to provide trusted communications focused on internal controls to customers (and their external auditors), investors, management, regulators and other stakeholders. These services efficiently address service organizations’ customer needs for trusted risk-based information.

• SOC 1 helps entities (service organizations) that operate information systems and provide business process services supporting financial reporting, build trust and confidence in their delivery processes and controls through a report they can deliver to their customers and customers’ external auditors.
• SOC 2/3 help entities meet the needs of a broad range of users that require information and assurance about the controls at the entity that affect the security, privacy, confidentiality, availability and processing integrity of entity’s systems.
• SOC for Cyber helps entities meet the needs of a broad range of users that require information and assurance about an entity's enterprise-wide cybersecurity risk management program.
• SOC for Supply Chain helps entities meet the needs of stakeholders that require information and assurance about an entity's system and controls for producing, manufacturing, or distributing goods to better understand the risks in their supply chains.

EY teams also provide pre-assessment services for a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report).

Agreed Upon Procedures (AUP) services help entities communicate independent results of controls testing or other procedures agreed upon between the entity and third-party recipients of the report. AUP engagements allow entities to communicate independent factual findings on control testing or other procedures to third-party recipients of the AUP report. EY teams present and report on a set of procedures that entities and the specified third party report users agree to, and the related findings resulting from the procedures.

ISAE 3000 reports on audit-related procedures that the auditor, entity and any appropriate third parties have agreed to (related to nonfinancial information):

• ISAE 3000 control testing – the capability to perform the procedures and control testing, leading to an assurance report (in accordance with the ISAE 3000 standard)
• ISAE 3000 implementation support and training – the capability to provide training on the execution of procedures, leading to an assurance report (in accordance with the ISAE 3000 standard)

The ISO Management System Certification, Implementation and Training services provide implementation and certification of a management system according to ISO standards and other established certification frameworks.

EY CertifyPoint B.V., an EY entity founded in 2002, is an accredited, independent, and impartial certification institute headquartered in the Netherlands. Through EY CertifyPoint, EY teams provide Lead Implementer and Lead Auditor courses, including certification of entity personnel for several ISO standards.

EY teams support entities in meeting their goals by improving the efficiency and effectiveness of their management systems. EY teams keep the business at the center, identifying areas of redundancy, bottlenecks and potential efficiency gains by means of a systematic and independent certification approach against a globally recognized standard.

The following standards are addressed:

• ISO 9001: Quality Management System
• ISO 14001: Environment Management System
• ISO/IEC 20000-1: IT Service Management System
• ISO 22301: Business Continuity Management System
• ISO/IEC 27001: Information Security Management System
• ISO/IEC 27017: Cloud Security Controls
• ISO/IEC 27018: Protection of Personally Identifiable Information in Cloud
• ISO/IEC 27701: Privacy Information Management System
• ISO 37001: Anti Bribery Management System
• ISO/IEC 42001: Artificial Intelligence Management System
• ISO 45001: Occupational Health and Safety Management System
• ISO 50001: Energy Management
• World Lottery Association (WLA) assessments
• CSA STAR certification
• NEN 7510-1: Health Information Security Management System
• Hébergeur de Données de Santé (HDS)
• Multi-Tier Cloud Security (MTCS - Singapore)
• GDPR assessment
• CISPE Code of Conduct accredited monitoring body
• Integrated approach with ISAE3402, SOC and other attestation reports, such as a combination of ISO/IEC 27001:2013 with ISAE3402

A system and process assessment includes an assessment of internal control as part of an upgrade or an implementation of an ERP (e.g., SAP S/4HANA), an application or a process. These services provide an independent assessment of an entity’s current state or a documented future state internal control to provide leading practice recommendations for management’s consideration. A system or a process upgrade or an implementation assessment helps the entity to:

• Obtain confidence that internal control considerations are adequately addressed.
• Understand complex business processes.
• Identify new risks and control gaps introduced by changes to process or technology and remediation recommendations based on leading practices.
• Enable the entity to take advantage of new capabilities that allow better leverage of investment in new process or technology, including opportunities for process automation and improvement, and GRC. integration, reporting and continuous control monitoring.

A pre-assessment of a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report), helps the entity to:

• Understand how to apply the evaluation criteria to the subject matter 
• Understand the disclosure requirements for the subject matter information (e.g., management’s description for a SOC report)
• Understand procedures performed to assess the subject matter information and/or controls

IT Compliance and Regulatory Assurance services help entities understand, prepare for, and report to address rapidly evolving laws, regulations and professional standards. These services help an entity more sustainably and efficiently address regulatory and sector-specific (e.g., Government, Healthcare, Financial Services) technology compliance requirements. Examples include helping entities comply with requirements related to:

• AI regulations (e.g., AI Act)
• Cyber security (e.g., Cyber Resilience Act, Cybersecurity Maturity Model Certification, Network and Information Security (NIS2) Directive)
• Data security (e.g., Data Act)
• Digital resilience (e.g., Digital Services Act, Digital Markets Act, Digital Operational Resilience Act)
• Sector-specific requirements (e.g., HITRUST, SWIFT, TISAX)
• Data and IT controls in ESG reporting 

The Singapore Evidence (Computer Output) Regulations’ (Evidence Act) First Schedule specifies the compliance criteria for image systems. This aims to reasonably ensure that the computer output from an image system provides an accurate representation of the original document and is admissible as evidence in court proceedings. 

Evidence Act certification services help organizations reduce the costs and time needed to prove the legitimacy of electronic records submitted in Singapore court litigation cases. 

Ernst & Young LLP is a certifying authority appointed by the Singapore Ministry of Law. EY professionals assess companies’ document imaging processes and the security of their imaging systems against compliance criteria in the Evidence Act’s First Schedule. A certification will be issued at the end of the assessment if no area of non-compliance was noted. A preliminary assessment may also be performed for companies that undergo the certification for the first time. 

Outsourced Service Provider Audit Report (OSPAR)

The Association of Banks in Singapore’s (ABS) Guidelines on Control Objectives and Procedures for Outsourced Service Providers (ABS Guidelines) requires all Singapore banks’ material outsourced service providers to engage an external auditor to issue an annual Outsourced Service Provider Audit Report (OSPAR). 

Ernst & Young LLP is recognized by the ABS as a Qualified Auditor authorized to issue the OSPAR. EY professionals assess organizations’ internal controls against the control criteria specified in the ABS Guidelines. A preliminary assessment may also be performed for organizations that undergo the OSPAR audit for the first time. 

MEPS+ Independent Assessment 

MAS Electronic Payment System (MEPS+) participant banks are required to perform a self-assessment against the requirements in the Monetary Authority of Singapore’s Operations and Contingency Manual for Participants and Non-Participants. The self-assessment is required to be independently reviewed biennially. 

EY professionals help banks perform the biennial independent review to verify the accuracy of their MEPS+ self-assessment and the effectiveness of implemented controls. 

Swift Customer Security Programme (CSP) 

Swift’s Customer Security Programme (CSP) helps customers strengthen their cyber defenses and requires them to perform annual attestation on their level of compliance against the Swift Customer Security Controls Framework, with an independent assessment.  

EY professionals help organizations that are Swift users to perform an independent assessment and comply with the CSP. 

MAS Notices and Guidelines Gap Assessment 

Financial institutions (FIs) operating in Singapore are required to comply with the Monetary Authority of Singapore’s (MAS) regulatory requirements specified in MAS notices, guidelines and circulars. 

EY professionals perform gap assessments for FIs against the technology-related MAS notices, guidelines and circulars, covering domains like technology risk management, cyber hygiene, outsourcing and business continuity management.  Each assessment is followed by a report highlighting identified gaps and recommendations to help the FI implement processes and controls to comply with regulatory requirements.  

IT Internal Audit 

EY professionals provide independent and objective IT assessments of an organization’s systems and processes. The objective is to provide stakeholders with confidence in the operating effectiveness of IT controls, appropriate management of IT risks and continued compliance with relevant regulations and standards. EY professionals also assess IT and cybersecurity controls against recognized practices and requirements, such as industry benchmarks, government instruction manuals and codes of practice for critical information infrastructure. 

Organizations also have the option of a co-sourcing agreement to tap into experienced EY teams’ industry insights and knowledge to help enhance their risk, compliance, governance and internal audit functions. 

Sarbanes-Oxley Act (SOX) and Internal Control over Financial Reporting (ICFR) Services 

Organizations listing on US stock exchanges are required to comply with requirements set out by regulators such as the US Securities and Exchange Commission and Public Company Accounting Oversight Board. 

SOX and ICFR controls need to respond to the challenges of ever-changing business and regulatory landscapes. EY multidisciplinary teams are equipped to help companies implement a robust SOX framework that meets their business needs and SOX regulatory requirements. 

These services include the following: 

• Scoping and readiness assessment to identify gaps, risks and areas for improvement 
• Testing to evaluate design and operating effectiveness of controls 
• Supporting the organization’s management in recommending and implementing remediation actions 
• Training to help the organization’s management raise awareness for SOX compliance 

Cybersecurity Assessments 

Organizations today face increasing cyber threats, heightened regulatory scrutiny and growing operational dependencies on technology. EY Cybersecurity Assessments provide a structured evaluation of an organization’s cyber risk management practices, governance frameworks and resilience capabilities. These assessments aim to identify gaps in both the design and operating effectiveness of controls across key cyber domains. 

EY professionals perform risk‑based and compliance-based cyber assessments aligned with recognized standards and frameworks and relevant industry or regional requirements. Depending on the organization’s objectives, the assessment can be conducted at a strategic level to provide executive insights or in greater depth to support detailed remediation planning and prioritization of cyber initiatives.  

The assessment outcomes help the organization’s management enhance governance and oversight, strengthen cybersecurity posture and improve preparedness against evolving cyber threats. 

Data Privacy and Protection 

Organizations in Singapore face growing expectations from regulators and customers to manage personal data responsibly in collection, use, disclosure, protection, retention and breach preparedness. The Personal Data Protection Act (PDPA) provides the baseline requirements, and organizations are increasingly expected to demonstrate accountability with evidence and not just policies. 

EY professionals help organizations assess PDPA readiness, identify gaps across people, processes and technologies and enhance privacy operations with practical, risk-based recommendations. EY professionals also support development of data inventories and ownership of data, conduct data protection impact assessments, assess breach readiness, support response planning and provide privacy training to help maintain compliance.  

Where needed, EY member firms can coordinate collaborations globally to address cross-border requirements. 

AI Governance and Assurance 

There is a growing need for AI governance, data readiness and compliance to keep pace with accelerating AI adoption as gaps in these areas can undermine trust, adoption and compliance readiness. 

EY professionals help organizations build trust and confidence in their AI ecosystem across three core components: AI-ready data, AI governance and controls, and AI systems and models.  

This involves assistance in strengthening foundations like clear data ownership and stewardship, classification, data quality, and end-to-end lineage and visibility of data flows, which are critical to scaling up AI use responsibly. 

EY professionals also provide structured maturity assessments, compliance and risk reviews, and assurance-oriented testing, such as governance and control testing, data quality checks, and model validation. Where relevant, test procedures are aligned with ISO/IEC 42001, which sets requirements for establishing and continually improving an AI management system. 

Together, such assistance helps organizations build trust in their data, strengthen governance and foster greater confidence in AI outcomes. 

In today’s dynamic environment, cyber incidents, technology or operational failures, regulatory changes, and other disruptions could occur anywhere and at any time. Organizations must be prepared to respond swiftly and effectively to protect their operations, reputation and stakeholders. Building resilience is a strategic imperative for organizations that seek to thrive amid uncertainty. 

EY professionals help organizations strengthen their continuity capabilities through a comprehensive assessment of business continuity or disaster recovery policies, governance structures, and recovery strategies. EY test procedures are aligned with recognized industry practices and relevant regulations, covering critical areas, such as risk identification, recovery objectives, technology dependencies and escalation protocols.  

EY professionals perform assessments to identify gaps that could impact operational readiness and provide tailored recommendations that help organizations safeguard critical processes, technologies and people. 

Managing IT assets has never been more critical. Organizations today operate across on‑premises infrastructure, cloud platforms, software as a service subscription and specialized engineering tools. Without structured ITAM, businesses risk overspending on unused licenses, facing vendor audit penalties and losing control over complex technological environments. 

EY ITAM assessments provide a clear view of how assets are governed and optimized across their lifecycle — from procurement to retirement. EY professionals work closely with organizations to identify gaps in entitlement mapping, usage tracking and vendor governance, helping them reduce costs, strengthen compliance and improve operational efficiency. Whether high‑level health checks or deep diagnostics are needed, the EY risk‑based approach helps organizations realize greater value from ITAM — such as greater cost savings, improved audit readiness and better visibility for informed technology decisions — without disrupting critical workflows.