ASAE 3150 assurance on controls

ASAE 3150, Assurance Engagements on Controls, is an Australian standard issued by the Auditing and Assurance Standards Board (AUASB). It sets out how an assurance practitioner plans, performs and reports an engagement on controls against suitable criteria.

It is a reporting standard, not a control checklist or a certification scheme. The criteria, control boundary, assurance level and assessment date or period need to be defined for the purpose of the engagement.

The Consumer Data Right gives consumers a way to authorise access to their data. Organisations applying for accreditation need to demonstrate that they meet the requirements relevant to their participation pathway, including information security requirements.

Where an independent assurance report is required, an ASAE 3150 engagement assesses the controls protecting the CDR environment against the applicable criteria. Throughline conducts the engagement and issues the report. The ACCC assesses the application and makes the accreditation decision; an assurance conclusion does not guarantee accreditation.

Start with your intended CDR role, services, data flows, systems and outsourced arrangements. Then confirm the current accreditation guidance, required report form, assurance level, control assertions and reporting date or period. Different participation pathways should not be assumed to have identical requirements.

The engagement may address control design, implementation or operating effectiveness, depending on its agreed purpose. Evidence needs to support the actual conclusion required, rather than simply demonstrate that policies exist.

Management owns the controls, the description of the environment and the evidence of how those controls operate. That includes decisions about access, data retention, suppliers, incident handling and the people accountable for them.

We independently evaluate the agreed subject matter, perform the required assurance procedures and report the conclusion and relevant findings. A named senior practitioner stays accountable from scoping through report issuance. Readiness feedback does not transfer management responsibility to the auditor.

ASAE 3150 is an Australian assurance standard that can be applied to defined control criteria. SOC 2 is an AICPA attestation report against the Trust Services Criteria. ISO 27001 is certification of an information security management system. None should be represented as automatically interchangeable.

Existing SOC 2 or ISO 27001 work can provide useful controls and evidence for a CDR engagement. Whether it meets a particular accreditation requirement must be checked against current guidance. If a customer asks for SOC 2, an ASAE 3150 report is not an AICPA SOC 2 report.