Consumer Data Right
Independent assurance over the controls protecting your CDR data.
Sydney headquartered CPA firm serving Australian and US companies
ASAE 3150 assurance for CDR accreditation in Australia.
The Consumer Data Right (CDR) lets consumers authorise accredited organisations to access and use their data. For applicants who require an independent information security assurance report, ASAE 3150 provides the Australian standard for reporting on controls. Throughline conducts these assurance engagements and issues ASAE 3150 reports scoped to the applicable CDR information security requirements. The report supports your accreditation application; it is not accreditation itself.
When you are applying to become an accredited data recipient and your accreditation pathway requires independent assurance over information security controls. It may also be relevant when an existing participant needs further assurance following changes to its systems or obligations. We confirm the current requirements for your role and pathway before agreeing the engagement.
CDR assurance, calibrated to your data flows
We start with your services, accreditation pathway and the systems that collect, process, store or disclose CDR data. A named senior practitioner leads the engagement from scoping through report issuance. We assess the controls you actually operate, including access, data lifecycle, service providers and incident response, against the applicable requirements. Management remains responsible for designing and operating controls; we independently assess them and report our conclusion.
Understand ASAE 3150 assurance on controlsQuestions we're often asked.
- Does Throughline issue ASAE 3150 reports?
- Yes. Throughline conducts independent ASAE 3150 assurance engagements and issues reports for the applicable CDR information security requirements. We agree the scope, assurance level and reporting requirements before starting.
- Does an assurance report give us CDR accreditation?
- No. The ACCC makes the accreditation decision. Your assurance report is one part of the supporting material, alongside the other requirements that apply to your application.
- What controls are assessed?
- The scope follows the applicable CDR information security requirements and the boundary of your CDR environment. It can include governance, access management, secure systems, information protection, monitoring, incident response and third-party arrangements. It is not a generic review of every system in your company.
- Can we use an existing SOC 2 or ISO 27001 assessment?
- Existing assessments and evidence may help, but they do not automatically replace the report required for your CDR pathway. We map the coverage, identify gaps and confirm whether any alternative evidence is permitted under the current accreditation guidance.
- Do all CDR participation pathways need the same report?
- No. The requirements depend on your role, accreditation level and participation arrangements. We establish which obligations apply before proposing an assurance engagement.
- How long does the engagement take?
- Timing depends on scope, control maturity, evidence availability and the required assessment date or period. We agree a realistic schedule after scoping rather than promise a fixed accreditation timeline.
How an engagement actually runs.
- 01. ScopeConfirm your accreditation pathway, CDR data boundary, applicable requirements and intended report users.
- 02. ReadinessReview your control descriptions and available evidence, and provide clear feedback on gaps before formal testing.
- 03. EvidenceAgree the assurance level, assessment date or period and evidence needed for the required report.
- 04. AssessmentPerform independent procedures, discuss findings promptly and evaluate their effect on the conclusion.
- 05. ReportIssue the ASAE 3150 assurance report for the agreed scope. Your organisation submits its accreditation application to the ACCC.
Ready when you are
Let's discuss your CDR accreditation needs.
A named senior practitioner will lead the conversation and stay accountable from scoping through report issuance.