Trust & Transparency Solutions

Third-Party Assurance – Beyond Controls over Financial Reporting

ISAE 3000, SAS 950, SOC 2®

Emerging technology and regulatory developments such as block chain, cloud, electronic patient health information, GDPR, and outsourcing regulation require organisations to look beyond the risks related to financial reporting.

Through the use of controls reports (referred to as SOC 2® or ISAE 3000 / SAS 950 using relevant and applicable industry controls standards, e.g. Trust Service Criteria or COSO/CoBiT Frameworks), we provide organisations and (internal and external) stakeholders with comfort when it comes to operational risk areas focusing on, for example, information security, (data) privacy, service availability, integrity and confidentiality. The typical (end) user audience of our reports is broad and ranges from internal / intra-group service recipients (e.g. IT shared service centres), recipients of outsourced services (e.g. data centre co-location services, cloud service providers, managed technology / IT services), regulators, customers and sometimes even the public in general.

Attestations of Other Specific Vendor Controls & Compliance Management Systems

SOC 2+, SOC 3, HITRUST

As the demand for trust and transparency in specific industry domains increases, we provide organisations with attestation solutions (e.g. SOC 2+ or SOC 3®) based on the latest control frameworks.
For example, we deliver attestation services in the health / pharma sector. Supported by PwC US, we deliver readiness, remediation and certification as a Certified HITRUST Assessor. We assist in the implementation of the HITRUST Controls Standard Framework (CSF) as the foundation of an organisation’s security and privacy controls / compliance programme for controlling risks related to patient health information (PHI).

Software Certification - SAS 870

The SAS 870 Software Certification assesses Information Technology General Controls, focusing on the software development cycle, business process controls, and other processes specific to the software’s purpose. It is evaluated against standards like CobiT, COSO, ISO 27002:2013, and other relevant criteria.

The certification provides a software certificate that can be shared with current and prospective customers, confirming the software meets predefined criteria, such as compliance with the Accounts Ordinance for electronic archiving systems.

Compliance Management Systems  - SAS 980

With the issuing of the Swiss Audit Standard 980 standards and guidelines regarding compliance management systems (CMS), we are able to assist organisations with addressing the different principles outlined in this standard. Our readiness, gap analysis and attestation activities tackle the required compliance culture, objective, risk, overall programme and organisation aspects of an organisation's legal, tax, corporate social responsibility (CSR) oversight or other compliance management systems.

Methodology

Our methodology to create transparency and generate trust between service providers and service recipients

PwC’s Trust & Transparency Solutions (TTS) team helps providers and recipients of outsourced services manage regulatory and business requirements so they can concentrate on their specific core business.

Our proven and leading controls reporting methodology provide you the following benefits:

• A unique and independent perspective on your organisation.
• A clear view on whether the expectations of all customers and their stakeholders are being met.
• An effective internal control framework aligned with your customers' expectations.
• A transparency knowledge transfer opportunity which enhances your company’s service quality.
• A state-of-the-art high quality controls reports in line with Swiss and, where needed, international assurance standards (such as ISAE 3402, ISAE 3000, PS 950, PS 980, SOC 1®, SOC 2®).
• An opportunity to be informed about the latest ‘niche’ control reporting standards* that might be beneficial for the industry and/or territory you are doing business in.