A dated snapshot.
Controls are examined at a specified date. This can be an interim step when evidence for a period is not yet available.
Understand how independent reporting on outsourced controls supports your customers’ financial reporting. Build your first timeline, explore the report types and plan your next step.
From preparation to report
Your indicative report month
Type 1 · a point in time
Request a proposal based on your organisation, audit scope and reporting needs.
A planning guide, not a delivery promise. The model allows one month for final audit work and, where needed, one month for preparation. Type 2 adds the selected review period. Significant gaps may require much longer preparation. Agree scope, period and delivery with the independent auditor.
Add your organisation size, service, scope and target date. Your planning scenario accompanies the request.
Open the enquiry form in a new tabWhen customers outsource relevant processes, their financial reporting still depends on those controls. An independent report helps customers and their financial statement auditors assess the service organisation.
Payroll, transaction processing, administration and supporting IT may be relevant. The connection to customers’ financial reporting determines the scope. PS 951 is not a general cybersecurity certificate.
Evidence for a decision. No blanket security guarantee.
The examination concerns a described system, relevant control objectives and related controls. The service organisation prepares the system description and assertion; the independent auditor assesses the agreed subject matter.
Identify relevant processes, transactions, systems, reporting outputs and subservice organisations. Explain the responsibilities retained by customers.
Both report types address the system description and design of controls. Type 2 also examines operating effectiveness throughout the agreed period.
Controls are examined at a specified date. This can be an interim step when evidence for a period is not yet available.
The auditor also examines operating effectiveness over the agreed period. Evidence must cover that period.
SOC 1 and ISAE 3402 concern controls relevant to user organisations’ financial reporting under different professional standards. IDW PS 951 is the German auditing standard for internal controls at service organisations. SOC 2 uses the Trust Services Criteria; ISO/IEC 27001 concerns an information security management system. Confirm the report your customer will accept.
Which report, scope and period are needed? Confirm the target date before making a commitment.
Describe services, processes, suppliers and controls. Identify missing evidence.
Name control owners, operate the controls and retain evidence. Software supports the work; it does not replace it.
Confirm scope, report type and timing with your auditor. Read the opinion, tests and exceptions.
The index helps buyers discover organisations and the assurance they state they hold. Acceptance of a report depends on the customer, scope and applicable requirements. A listing does not authenticate a report or confirm current compliance.
Explore organisations in the index ↗This platform is an independent directory, not an official register operated by the standard setter.
About this platform ↗Understand the report before buying software, promising a deadline or agreeing an audit scope.
Show my planning ↑IDW PS 951 is the German auditing standard for examining internal controls at service organisations. It concerns controls relevant to the financial reporting of user organisations, within a defined system and at a specified date or over a period.
Service organisations whose activities affect their customers’ financial reporting may be asked for one. Payroll, transaction processing, administration and supporting IT are examples. The service and customer requirement determine the scope.
The result is an independent assurance report, rather than a general certificate for the whole business. Read its scope, date or period, opinion and exceptions.
Type 1 addresses the system description and design of controls at a specified date. Type 2 also addresses operating effectiveness over an agreed period and includes tests of controls and their results.
Not necessarily. Type 1 can be an interim step. Agree the required report and available evidence with your customers and their financial statement auditors.
Preparation, the reporting period and final audit work determine the timeline. The calculator provides a planning scenario. Agree the actual timetable with the independent auditor.
Processes, systems, locations, scope, report type and readiness influence the fee. Compare preparation and independent audit costs separately. After viewing your plan, provide organisation details to request a tailored proposal.
Relevant services, processes, transactions, systems, control objectives, controls and reporting outputs. Include subservice organisations and complementary controls expected from customers.
Examples include reconciliations, processing approvals, access reviews, change logs and error handling. Evidence follows the relevant control objectives. For Type 2, it must support the agreed period.
These are controls customers must operate for the control objectives to be achieved. Customers and their auditors assess them alongside the service organisation’s report.
Certain controls at a subservice organisation are excluded from the examination. Review the dependency and any separate evidence needed. An excluded supplier is not automatically covered by the report.
No. PS 951 concerns controls relevant to user organisations’ financial reporting. SOC 2 uses the AICPA Trust Services Criteria, including security and availability. Choose the report that addresses the customer’s purpose.
Not automatically. ISO/IEC 27001 concerns an information security management system. It does not itself provide the required opinion on the service’s financial reporting controls.
A suitably qualified, independent auditor performs the engagement under the applicable professional standards. Confirm competence, independence and customer acceptance before appointment.
A report concerns a specified date or period. It is not a permanent statement about current controls. Agree the reporting cycle with customers and consider gaps between periods.
Reports are generally intended for user organisations and their auditors with an appropriate understanding of the service. Ask for the current report and its access conditions.
Acceptance depends on the customer, their auditor, the standards applied and the scope. Agree the required assurance and report format before starting. PS 951 is a German standard; international customers may request ISAE 3402 or SOC 1.
No. A listing helps discovery. Obtain the original current report and assess its scope, period, opinion, exceptions and complementary user entity controls.
The applicable professional standards and engagement terms determine the examination.
IDW: PS 951 n.F. ↗Reviewed: 15 November 2026