Start with who will read the result
Ask who requested the audit and what they will do with it. A customer contract, a card payment obligation, an insurer, a board and a chief executive with doubts about the IT provider each need a different output. If a contract or regulator names a specific examination, confirm its exact wording before agreeing any engagement.
| Type | The question it answers | Asked for by, and performed by |
|---|---|---|
| SOC 2 report | Are a service organization's controls suitably designed against the Trust Services Criteria in scope? A Type 1 report covers design at a point in time; a Type 2 report also covers operating effectiveness over a period. | Customers of a company that provides services to other businesses. Performed by a licensed CPA firm under professional assurance standards. |
| ISO/IEC 27001 certification audit | Does the organization's information security management system meet the standard? | Customers, partners and tenders that require certification. Performed by a certification body. |
| Penetration test | Can a tester, with permission, get past specific defences at a point in time? | Security teams, customers, insurers or a board after an incident. Performed by a qualified security specialist within an agreed scope. |
| PCI DSS assessment | Does the handling of payment card data meet the card industry standard? | The bank or payment processor that handles card payments, which also decides how compliance is validated. Performed by a Qualified Security Assessor, or by the business itself through a Self-Assessment Questionnaire where it is eligible. |
| IT controls in a financial statement audit | Which systems and controls matter to the risks in financial reporting, and can the auditor rely on them? | Part of the financial statement audit, performed by the organization's external auditor. A separate auditor's opinion on internal control over financial reporting, required of some public companies, is a different engagement. |
| Independent IT audit of your provider | Is what the IT provider reports supported by evidence: security, backups, access, spending and the contract? | Owners, chief executives, finance leaders and boards. Performed by a firm that does not manage or sell the technology it examines. |
When a customer or contract asks for a specific audit
A request for a SOC 2 report, ISO 27001 certification or a PCI DSS assessment names a formal examination with its own standard, scope and authorized examiners. Another kind of review does not substitute for it. Ask the requester which report, which period and which systems they expect, and plan the engagement around that answer.
When the question is whether your IT provider is doing what it reports
Most organizations of 25 to 250 people do not need a certification to answer this question. They need someone with no stake in the answer to examine the evidence: whether backups restore, whether security controls are active, who has administrator access, and whether billed services match the agreement. That is an independent IT audit, sometimes called an independent IT review or a second opinion.
The Canadian Centre for Cyber Security's guidance for consumers of managed services covers many of the topics such a review examines, including provider assessments, access control, recovery and exit arrangements.
What actually.'s independent review does not include
- It does not issue a SOC 2 report or ISO 27001 certification.
- It is not an audit of your financial statements.
- It is not a penetration test. Where specialist testing is appropriate, its scope and findings can form part of the evidence.
- It is not a sales assessment from a provider that wants to replace the one you have.
Questions to settle before choosing
- Who asked for the audit, and what will they do with the result?
- Does a contract, customer or regulator name a specific standard or report?
- Which systems, providers and time period does the question cover?
- Does the examiner have any interest in the outcome, such as selling the remediation work?
- What will the output be: a certificate, an attestation report, a test report or a plain language findings report?
If you are comparing quotes, see what an independent IT audit costs in Canada. If an assessment was offered free by a provider, read the free IT assessment catch first.
