COVID-19 AWARENESS: Xcina Consulting is open and operating, as usual, and here to support organisations during these challenging times. We are available to provide risk assurance and advisory services to help navigate the challenges of the new ways of working. Contact Us
Menu Close

Case Study

Control Assurance Audit (ISAE3402 Type 1) and Accreditation to ISO/IEC 27001 for Software Provider

The client

A leading provider of strategic management software for End User Computing (EUC) who is committed to ensuring the integrity of business operations. Trusted by world leading institutions in 20 countries on five continents their solutions help firms balance their governance, risk and regulatory compliance (GRC) obligations with the need for revenue generation, staff efficiency and productivity.

The work

Having developed a new Software as a Service (SaaS) platform for clients, customer demand for external accreditations, and the importance of services supporting customer regulatory compliance, the client wanted to provide buyers with assurance over the rigour they apply in the design, control and ongoing development and operation of their services.

How we helped

We worked with the UK board, and investors, to agree that the assurances
that would most likely be demanded by purchasers would be the International Standard on Assurance Engagements (ISAE 3402) Assurance Report on Controls at a Service Organization and the International Information Security Standard (ISO/IEC 27001).


Our Information Security consultants undertook a gap analysis of the client control environment against both ISAE3402 and ISO/IEC 27001 to prepare a comprehensive gap analysis and required remediation plan. We then worked with operational management to enhance their Information Security Management System (ISMS) to establish a common control
framework that could be operated to meet the requirement of both Standards. By working collaboratively we helped the client successfully obtain a Type 1 ISAE3402 attestation and to gain certification to ISO/ IEC 27001 via both Stage 1 and Stage 2 audits on the first attempt.

Value added

By focussing on the reporting requirements of both Standards, and control overlap between them, we were able to design a single control framework that could be operated as part of their Business As Usual (BAU) operations which was operationally efficient and reduced the overall cost of compliance.

Customer reviews

What our clients say

Get in touch

If you would like to talk about your risk management requirements, submit your details and one of our consultants will be in touch.