Category: Advisory

Home / Advisory
Sep152019

SOC 2 vs. SOC 1 type 2

SOC 2 vs. SOC 1 type 2

An ISAE 3000 | SOC 2 report and an ISAE 3402 | SOC 1 type 2 report are similar in design. The biggest difference, however, lies in the scope (testing framework)

An ISAE type 2 report

An ISAE 3402 | SOC 1 report is an assurance statement that is issued to an organization. An ISAE 3402 | SOC 1 type 2 report discusses how the service provider manages risks related to outsourced processes. The assessment framework is formed by the outsourcing itself and the financial processes (is there a relationship with the annual accounts?). It is customary in the financial world in particular to be able to demonstrate an ISAE 3042 | SOC 1 assurance statement. For example, a financial institution will always require an ISAE 3402 | SOC 1 report from suppliers before the supplier is allowed to provide the services.

ISAE 3402 | SOC 1 is based on the requirement that the objectives must relate to the needs of the account of the organization that purchases the service. In other words: the control framework (control objectives and measures) can be put together at ISAE itself. The idea behind this is that the risks of outsourcing activities depend on the situation. The management objectives and measures that are based on this are therefore a piece of custom work.

An ISAE 3000 | SOC 2 report

In an ISAE 3000| SOC 2 report, the assessment framework is not formed by the outsourcing itself, but rather by information security. ISAE 3000 | SOC 2 reports therefore do not focus on financial processes, but on Trust Services Criteria such as security, availability, confidentiality, processing integrity and privacy in a service organization. In an ISAE 3000 | SOC 2 report, the scope is therefore determined by these predefined management objectives (Trust Service Criteria).

ISAE 3000| SOC 2 is mainly about ensuring that the data that is processed or hosted has no effect on the financial statements of clients. These clients are particularly interested in whether information security and privacy are handled correctly. For example, in an ISAE 3000| SOC 2 report, one can think of obtaining certainty about external Cloud services.

Jul212019

The relationship between ISAE 3402 and ISA 402

The relationship between:

ISAE 3402 and ISA 402

The ISAE 3402 standard states that reports made in accordance with ISAE 3402 already provide sufficient evidence under ISA 402, audit considerations relating to an entity using a service organization. In other words, ISA 402 focuses on the responsibility of the user organization to obtain adequate and appropriate control information when a user organization uses one or more service organizations. It is important to note that many financial reporting standards, as well as a number of supporting standards, also play a role in interpreting, understanding, and facilitating that standard itself, as is the case with the ISAE 3402 standard.

Jul212019

How Does a Service Organisation Prepare for ISAE 3402?

How Does a Service Organisation

Prepare for ISAE 3402?

The ISAE 3402 standard requires service organisations to take a proactive approach in meeting the requirements imposed by the service auditors (accountants). Therefore, service organisations can greatly benefit from conducting an ISAE ‘Readiness Assessment,’ which will help in understanding the reporting requirements.

These reporting requirements include:

  1. Preparing a description of the service organisation’s system.
  2. Preparing a written management statement of assertion, which will be included in the final ISAE 3402 report.

Additionally, an internal audit within the service organisation may be involved in the entire assurance process if the service organisation’s auditor deems their objectivity and professionalism acceptable. Thus, conducting an ISAE 3402 ‘Readiness Assessment’ will be crucial for service organisations in understanding the scope of the assignment as well as comprehending the reporting requirements for the ISAE 3402 standard.

Jul212019

What is a Data Breach and What Can My Organisation Do About It?

What is a Data Breach and

What Can My Organisation Do About It?


Nowadays, there is increasing news about data breaches. Entire documents and data from companies, as well as their stakeholders, are easily accessible. This can have many consequences for the stakeholders, but perhaps even more for the company.

The Dutch Data Protection Authority has defined a data breach as an incident involving access to or destruction, alteration, or unauthorized disclosure of personal data at an organisation without the intention of the organisation itself.

A data breach is an incident where information is stolen or extracted from a system without the knowledge or consent of the system’s owner. Both small businesses and large organisations can experience a data breach. Stolen data can include sensitive, proprietary, or confidential information such as credit card numbers, customer data, trade secrets, or matters of national security.

The consequences of a data breach can manifest as damage to the target company’s reputation due to a perceived ‘betrayal of trust’. Victims and their customers may also suffer financial losses if related data is part of the stolen information.

In this case, prevention is better than cure. Once data is exposed, it is difficult to remove. Moreover, removing the software is often not effective and is not done completely. Therefore, prevention is the best solution.

Every Company Can Address the Following Vulnerabilities:

  1. As previously mentioned, it is crucial to use the most recent operating and security systems.
  2. All programs should also be up-to-date. No errors can be allowed here.
  3. Never click on strange links in emails. Many spam emails come through websites. Always check whether it is a standard email with a link or an actual potential customer with questions.
  4. Get ISO 27001 certified. Information security is essential for every company. The ISO 27001 standard is an international framework for information security. ISO 27001 can be used to organise information security.