Third-Party Assurance
What is Third-Party Assurance?
Independent verification by an external party that an organisation's controls, processes, or systems meet specified criteria. SOC reports, ISO certifications, and penetration test reports are common forms of third-party assurance.
Terms that appear alongside third-party assurance
Each of these is named in at least one of the same controls as third-party assurance. The number is how many controls name both.
- audit 4 shared controls
- cybersecurity 3 shared controls
- soc 2 3 shared controls
- data protection 2 shared controls
- gdpr 2 shared controls
- breach notification 2 shared controls
- data subject 2 shared controls
- due diligence 2 shared controls
Frameworks that govern third-party assurance
What the standards actually require on third-party assurance
Requirements naming third-party assurance across 6 standards, quoted from the control text.
Internal audit has to assess the security control assurance a related or third party provides where both hold: (a) an incident affecting the assets could have a material financial or non-financial effect on the entity itself or on the interests of its deposito...
apra-cps-234::34 · Para 34 Internal audit assessment of third-party assurance →GRI Standards implementation roadmap. ORGANIZATIONAL ROLES: (a) CHIEF SUSTAINABILITY OFFICER (CSO) / VP SUSTAINABILITY - strategic ownership + Board engagement; (b) SUSTAINABILITY MANAGER / GRI REPORTING MANAGER - operational reporting lead;
GRI-Implementation-Roadmap-Roles-Reporting-Process · GRI Implementation Roadmap, Organizational Roles, Reporting Process and Tooling →Consider the whole supply chain when setting cyber strategy and plans and build a framework covering business processes including third parties; build what is needed to manage third-party cyber risk across the lifecycle and set a third-party risk policy;
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.6-B · 2.6 Third-party risk management: basic actions →Section 5 of Kentucky CDPA establishes the Processor Contract framework + closely modelled on VCDPA Virginia + GDPR Article 28. (1) Section 5 Processor Definition: (a) Person processing personal data on behalf of controller;
KY-CDPA-Processor-Contracts-Section5-Confidentiality-Subprocessor-Authorisation-Audits-Sub-Processor · Kentucky CDPA Processor Contracts + Section 5 + Confidentiality + Subprocessor Authorisation + Audits + Sub-Processor Flow-Down + Documented Instructions + Data Deletion + Cooperation + Mandatory Contract Terms →Per PCAOB Auditing Standard AS 2201 paragraphs 4-14: plan the audit + scale + apply risk assessment + integrate with financial statement audit.
ASTWO-1 · Audit Planning, Scaling, Risk Assessment, and Integration →Disclosures should be accurate and reliable, so the entity should design, implement and maintain governance over developing and disclosing sustainability information (management involvement, board oversight, internal control) substantially similar to that for...
sasb-standards::SAG-5.0 · SAG-5.0 Govern and control sustainability disclosures much as financial reporting is controlled, and give narrative context per topic →Questions people ask about third-party assurance
What is Third-Party Assurance?
Why is Third-Party Assurance important for compliance?
Which compliance frameworks address Third-Party Assurance?
Where can I learn more about Third-Party Assurance?
See how Third-Party Assurance applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.