Are your clients outsourcing finance-related functions to you and expecting verifiable proof of your control structures?
With an audit report according to IDW PS 951, you document the appropriateness and, depending on the report type, the effectiveness of your service-related internal control system.
Certinova guides you efficiently through the entire process: from the initial readiness assessment and the definition of scope and control objectives to the certified Type 2 report according to IDW PS 951 or ISAE 3402.
Get the compliance certification that satisfies your clients now!
%20(5).png)
Digital workflows and reusable evidence reduce manual effort – especially during re-certification.
Numerous completed audit and assessment projects form the basis of our methodology.
SaaS providers, cloud platforms, IT service providers, and regulated companies rely on Certinova
Regardless of where you are starting from, we provide the right service for your current level of maturity – without detours and without overhead.
We assess your financial reporting-relevant controls against the requirements of IDW PS 951 or ISAE 3402, uncover gaps, and prioritize measures. You start with a realistic picture and an actionable roadmap.
.svg)
A Type 1 report assesses whether your service-related internal control system is appropriately described, designed, and implemented as of a defined date. It is the ideal starting point for meeting client requirements at short notice and laying the foundation for a subsequent Type 2 report.
.svg)
A Type 2 report additionally assesses whether the described controls were in place and functioned effectively over a defined period.
IDW PS 951 can be effectively combined with SOC 1 as well as with supplementary security and compliance certifications such as SOC 2, C5, and ISO 27001. Depending on the business model, IDW PS 880 as well as requirements from NIS2 and DORA can also be integrated into the control mapping.
We combine professional assessment by experienced auditors with technology-driven processes.
The result: shorter audit cycles, less internal effort for you, and reports that meet your customers' requirements.
Evidence is collected in a structured manner and automatically validated – the professional assessment remains with our auditors.
Submit documents, answer questionnaires, track status—transparent instead of endless email chains.
A clear audit pattern from scope to report—fewer follow-up questions, predictable effort.
An experienced team supports you beyond the individual report—including follow-up audits and related frameworks.
From the distinction between Type 1 and Type 2 to your clients' requirements and the final audit report: here you will find the most important answers regarding the audit of your service-related internal control system (ICS).
Is your question not listed here? Please contact us directly.
The choice depends on which controls need to be verified and the requirements set by your clients and their auditors. IDW PS 951 is particularly suitable for service companies with clients in Germany if the services are relevant to their financial reporting. SOC 1 or ISAE 3402 is the appropriate international alternative. SOC 2, on the other hand, focuses on information security and data protection. Depending on your business model, a combination may be sensible. During the scoping process, we will clarify which report and which audit scope best suit your requirements.
A Type 1 report assesses whether your controls are appropriately designed and implemented as of a specific date. A Type 2 report additionally provides evidence that the controls have functioned effectively over a defined period, usually six to twelve months. Type 1 is suitable as an entry point or for short-term verification. For use in the context of a financial statement audit, clients and their auditors usually expect a Type 2 report.
Yes. IDW PS 951 and ISAE 3402 or SOC 1 pursue comparable objectives and can be aligned with one another. SOC 2 can be added if there are additional requirements to be demonstrated regarding information security, availability, or data protection. Through a joint control mapping, controls, responsibilities, and evidence can be used for multiple report formats. The scoping process determines which content can be adopted and which additional audit procedures are required.
The key factors are an appropriate audit scope, relevant control objectives, the correct report type, and a sufficiently long audit period. We coordinate these points with you at an early stage and, wherever possible, with the requirements of your key clients and their auditors. This results in a report that can be used specifically as evidence in your client's audit file.
Let's get in touch to discuss your requirements.
