ISAE 3000 / ISAE 3402(GDPR)

Across society, digitalization has increased awareness of IT and information security.

The topic has moved into the boardroom, with regulators continuously passing new legislation and issuing fines for non-compliance.

Why is IT auditing important for many businesses?

At its core, IT auditing is about being able to show customers, partners and the outside world that you have your house in order and have a professional approach to information security management.

This doesn't just apply to larger organizations. In practice, it is a requirement or expectation for all companies that provide IT services or handle personal data as a data processor. And that's more than many of us realize.

What is an IT auditor's report?

In the context of IT auditing, there are several types of auditor's reports for different purposes and companies. They can also cover different time periods. What the statements have in common is that they are international assurance standards. Therefore, the IT audit also serves as documentation for customers and business partners abroad.

Two of the most common IT auditor statements are ISAE 3000 - Data Processor Statement and ISAE 3402 - General IT Controls.

You can find out much more about IT audits and IT auditor statements on these pages:

• What is an IT auditor's report?
• ISAE 3000 and ISAE 3402
• Why choose an IT auditor's report?
• How do I get an IT auditor's report?

You can also download our pdf publication on the topic: ISAE 3000 and ISAE 3402 - Auditors' Statements on Information Security and Data Processing Agreements (GDPR).

Want to know more about IT auditing?

If you want to know more about IT auditing, what the different types of statements require and how they can improve security and quality in your business, contact us for a no-obligation sparring session.