Technology Risk

The Service Organization Control Reporting (SOCR) services enable entities to provide trusted communications focused on internal controls to customers (and their external auditors), investors, management, regulators and other stakeholders. These services efficiently address service organizations’ customer needs for trusted risk-based information.

• SOC 1 helps entities (service organizations) that operate information systems and provide business process services supporting financial reporting, build trust and confidence in their delivery processes and controls through a report they can deliver to their customers and customers’ external auditors.
• SOC 2/3 help entities meet the needs of a broad range of users that require information and assurance about the controls at the entity that affect the security, privacy, confidentiality, availability and processing integrity of entity’s systems.
• SOC for Cyber helps entities meet the needs of a broad range of users that require information and assurance about an entity's enterprise-wide cybersecurity risk management program.
• SOC for Supply Chain helps entities meet the needs of stakeholders that require information and assurance about an entity's system and controls for producing, manufacturing, or distributing goods to better understand the risks in their supply chains.

EY teams also provide pre-assessment services for a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report).

Agreed Upon Procedures (AUP) services help entities communicate independent results of controls testing or other procedures agreed upon between the entity and third-party recipients of the report. AUP engagements allow entities to communicate independent factual findings on control testing or other procedures to third-party recipients of the AUP report. EY teams present and report on a set of procedures that entities and the specified third party report users agree to, and the related findings resulting from the procedures.

ISAE 3000 reports on audit-related procedures that the auditor, entity and any appropriate third parties have agreed to (related to nonfinancial information):

• ISAE 3000 control testing – the capability to perform the procedures and control testing, leading to an assurance report (in accordance with the ISAE 3000 standard)
• ISAE 3000 implementation support and training – the capability to provide training on the execution of procedures, leading to an assurance report (in accordance with the ISAE 3000 standard)

A system and process assessment includes an assessment of internal control as part of an upgrade or an implementation of an ERP (e.g., SAP S/4HANA), an application or a process. These services provide an independent assessment of an entity’s current state or a documented future state internal control to provide leading practice recommendations for management’s consideration. A system or a process upgrade or an implementation assessment helps the entity to:

• Obtain confidence that internal control considerations are adequately addressed.
• Understand complex business processes.
• Identify new risks and control gaps introduced by changes to process or technology and remediation recommendations based on leading practices.
• Enable the entity to take advantage of new capabilities that allow better leverage of investment in new process or technology, including opportunities for process automation and improvement, and GRC. integration, reporting and continuous control monitoring.

A pre-assessment of a draft subject matter such as a system description prior to the performance of a limited or a reasonable assurance engagement (e.g., SOC report), helps the entity to:

• Understand how to apply the evaluation criteria to the subject matter 
• Understand the disclosure requirements for the subject matter information (e.g., management’s description for a SOC report)
• Understand procedures performed to assess the subject matter information and/or controls