EMEIA service provider survey 2015 results. Building trust with your clients in an outsourced world

Transcription

1 EMEIA service provider survey 2015 results Building trust with your clients in an outsourced world

2 Overview Key findings EMEIA service provider survey background Survey results Why are you obtaining independent assurance reports? Are independent assurance reports meeting your and your client s needs? Are independent assurance reports reducing the overall costs of providing assurance? Do you discuss the need for independent assurance reports with clients? What are the latest trends? Are independent assurance reports helping you manage the assurance process? About EY Appendix Page 2

3 Key findings Clients are looking for service organizations to provide cybersecurity assurance around the critical infrastructure Top area seeing an increased interest for independent assurance from clients is: security Over 75% of respondents indicated their clients are showing increased interest in, or demand for, independent assurance around security, and both in EMEIA and globally, concerns around cybersecurity are likely to be driving much of this. SOC1 (ISAE 3402) is still the main independent assurance standard but, on top of this, clients are increasingly asking for additional assurance using standards such as SOC2 and ISO Increased demand for SOC2 reports Respondents currently providing SOC2 reports as a standard offering or as part of a specific contract showed an almost 80% increase from the 2013 survey. One out of four respondents said that they planned to provide an SOC2 report as part of their standard service offering in the next months. Other areas showing growth in interest and demand include data privacy and cloud The area with the highest increase in interest from clients since 2013 is data privacy. Over two-thirds of respondents stated that clients were showing increased interest or demand for independent assurance around data privacy, which may be driven by changes in EU data privacy regulations. There was also an increase of over 20% in clients showing interest in assurance over cloud-based services. This is likely to be driven by increased take-up of these services. Service providers are seeing more benefits from assurance reports According to respondents, the main reason for providing independent assurance reports to their clients is to reduce supplier audits. Compared with 2013, there was a large increase in respondents who said they use assurance reports to reduce the number of supplier audits, and a significant drop in service providers who said they provide reports due to contractual or compliance requirements. Decreased time spent by service organizations in providing assurance to clients outside their assurance reports Total internal time spent providing assurance to clients has reduced from One-third more respondents stated that they spend one month or less providing assurance to clients. This could be due to a combination of factors, including: Clients increased their reliance upon assurance reports provided by service providers, with the result that fewer supplier audits had to be requested. Increased number of assurance reports provided by service providers. Service providers were better aligned with client demands. Page 3

4 Background and participants (1/2) The service provider survey was created to obtain more in-depth information from service providers about Service Organization Control Reporting (SOCR) and the actual and planned usage of the these reports in future. The results of the first EMEIA survey were presented in 2013 and, during the year end of 2014 this second edition was completed by the participants and the results were processed during the spring of More than 125 respondents from leading service providers in various industries across Europe, Middle East, India and Africa (EMEIA) completed the survey. The results have been analyzed in the following pages with an interpretation summary and conclusion. Where interesting, a comparison with 2013 has been made. Total number of employees Annual revenue > 50,000 8% 13% 15% 20,000 to 50,000 2% 8% 10,000 to 19,999 1% 22% 2,500 to 9,999 19% 23% 500 to 2,499 26% 19% 250 to % < 10m 10m 50m < % 50m 500m 100m 500m 500m 1b > 1b Page 4

5 Background and participants (2/2) Outsourcing services provided to clients Managed networking services 7% 27% Managed security services Full IT outsourcing (hosting, application support, security management and user support) 2% 9% 27% 53% IT hosting (including co-location and cloud services) 29% 50% Other process outsourcing (e.g., customer management, logistics) 6% 20% Finance process outsourcing (e.g., purchase to pay, order to cash) 3% 14% Payroll and HR services 14% 20% Financial services - pensions administration 6% 4% Financial services - insurance 2% 7% Financial services - core banking services 9% 15% Financial services - asset management 15% 14% 0% 10% 20% 30% 40% 50% 60% * Respondents were allowed to select multiple services Page 5

6 Survey results Why are you obtaining independent assurance reports? Page 6

7 Summary The assurance options provided by most service organizations are typically a combination of SOC1 and ISO certifications. SOC1 is still the dominant force in SOC reporting, but we see a shift in growth rates. Although SOC1 reports are continuously seen as important, we see expanding assurance added on top of SOC1 reports by SOC2 reports. As a result, SOC2 reports have shown the greatest increase since Organizations currently providing SOC2 reports as a standard offering have increased from 9% to 16%; those offering SOC2 as part of specific contracts have increased from 10% to 18%; and the number of respondents planning to offer SOC2 reports in the next months has increased from 13% to 25%. The 25% also includes organizations that currently supply the SOC2 report. ISO certifications as a standard offering increased from 35% to 44%, while planned ISO certifications remain steady compared to During the survey 68% of respondents indicated that they provide independent assurance reports to reduce supplier audits. In 2013, only 53% of respondents indicated they provide assurance reports to reduce supplier audits. Since 2013, there was also a 13% drop in respondents that indicated they provided reports due to contractual or compliance requirements. Results analysis The reasons why service providers provide independent assurance are changing. The key driver for independent assurance remains unchanged and is a contractual or regulatory requirement. However, the current survey shows that, compared with 2013, service providers unlock potential time savings by creating a win-win situation when managing both the contractual or regulatory requirements and by having SOC reports in order to reduce the number of supplier audits. Page 7

8 Why are you obtaining independent assurance reports? (1/4) Do you currently provide independent assurance to your clients or user organizations? Do you plan to start to provide independent assurance to your clients in the next 6 18 months? 17% 30% 83% 70% Yes No Yes No The main reason why service providers do not provide independent assurance to clients is because their clients do not request or require this assurance. Page 8

9 Why are you obtaining independent assurance reports? (2/4) How many independent assurance reports do you currently supply to your user organizations each year, considering your global organization? 37% 37% 27% 22% 19% 15% 10% 11% 8% 14% > 30 64% Still 14% of the respondents provide more than 30 assurance reports to their clients. More than half of respondents (64%) provide fewer than five assurance reports to their clients. Page 9

10 Why are you obtaining independent assurance reports? (3/4) What assurance reports do you 82% 77% 63% 44% 43% 25% 16% 18% 5% 2% 5% 9% 19% 17% 18% 17% 12% 4% 2% 6% 25% 29% 20% 14% SSAE 16 / ISAE 3402 (collectively known as SOC1) SOC2 SOC3 (also known as WebTrust / SysTrust) ISAE 3000 or other assurance reports ISO ISO ISO Other ISO certificates currently supply to your user organizations as part of your standard service offerings? currently supply as part of specific contracts with specific user organizations? plan to supply to your user organizations as part of your standard service offerings in the next months? * Respondents were allowed to select multiple answers for each category As a standard service offering, ISO certifications increased from 35% to 44% compared with the previous year. From 2013 to 2015, SOC2 reports increased from 9% to 16% compared with the previous year. Page 10

11 Why are you obtaining independent assurance reports? (4/4) Why do you provide independent assurance to your user organizations? Allows us to manage the audit process and the resulting messages that are sent to our clients 39% 37% Provides valuable feedback on how our teams are operating Reduces number of supplier audits Seen as providing competitive advantage in winning work (competitors do not provide this independent assurance) 53% 53% 53% 68% 69% 71% Contractual or compliance requirement to provide independent assurance 73% 84% 0% 20% 40% 60% 80% 100% * Respondents were allowed to select multiple answers In % of organizations supplied independent assurance reports to reduce the number of supplier audits versus 53% in Page 11

12 Survey results Are independent assurance reports meeting your and your client s needs? Page 12

13 Summary There is an increase in request for proposals (RFPs) asking if service providers have assurance reports. Since 2013, 15% more respondents indicated that the RFPs include a question asking if service providers have assurance reports. Over half (59%) of all assurance reports are not tailored sufficiently to meet the entire scope of client needs resulting in their own independent assurance work. Independent assurance report does not cover all the requirements for internal control (governance). The ISAE 3402 report is quite often generic and clients require more details and assurance for different periods. Results analysis More clients appear to be looking for service providers with independent assurance reports. While a mismatch in scope and coverage of the independent assurance reports still remains the main reason for clients performing their own audits at the service provider, communication and managing expectations through, e.g., pre-assessments with client s involvement, will help improve client understanding and perhaps see the scope better address their needs. Page 13

14 Are independent assurance reports meeting your and your client s needs? (1/3) For your clients that receive independent assurance report(s) from you, how many still perform their own audits on the services covered by these independent assurance reports? For areas not covered by your independent assurance reports, how many of your clients then perform their own audits on these areas? 6% 4% 3% 5% 9% 4% 4% 7% 17% 65% 15% 61% < 10% 10% 30% 30% 50% 50% 70% 70% 90% > 90% The majority indicated that less than 10% of their clients still perform their own audits on the services covered by the independent assurance reports. Clients appear to have still a wide range of needs not entirely being met by the independent assurance reports currently being provided. < 10% 10% 30% 30% 50% 50% 70% 70% 90% > 90% The majority of service organization clients do not conduct their own audit of areas not covered by the assurance report possibly due to cost pressure. The results did not significantly change from 2013 for both questions. Page 14

15 Are independent assurance reports meeting your and your client s needs? (2/3) Why do your clients still perform their own audits on the services covered by these independent assurance reports? Not applicable clients do not perform their own audits 34% 33% The regulatory agenda is not covered in the assurance report 10% 17% The assurance report period is inappropriate 8% 8% The independent assurance report does not cover all client relevant service parts 46% 59% 0% 10% 20% 30% 40% 50% 60% 70% * Respondents were allowed to select multiple answers The majority of the service clients indicate that they conduct their own audit because the independent assurance report does not cover all client relevant service parts. Page 15

16 Are independent assurance reports meeting your and your client s needs? (3/3) How many of the RFPs you respond to ask if you have an independent assurance report? 22% 21% 21% 18% 18% 18% 18% 14% 13% 12% 14% 12% <10% 10% 30% 30% 50% 50% 70% 70% 90% >90% The majority of respondents indicated that at least half of their RFPs included a question about the availability of an independent assurance report. Based on this, most clients appear interested in their service organizations maintaining a level of independent assurance. Page 16

17 Survey results Do you discuss the need for independent assurance reports with clients and what are the latest trends? Page 17

18 Summary Security, availability and data privacy are the greatest drivers for increased demand for independent assurance. This increased demand appears to be resulting in a higher number of clients pursuing assurance through ISO certification or SOC2 reports. Since 2013, the area with the highest increase in interest from clients is data privacy. In 2013, 59% stated clients were showing interest or demand for data privacy, while in 2015, 70% of respondents stated that clients were showing increased interest or demand for independent assurance in this area. There was also over a 20% increase in clients showing interest for assurance in cloud based services since In 2015 the majority of the respondents (76%) indicated that the independent assurance approach is discussed annually or at the request of the client. Only 15% of respondents indicated that the independent auditors are proactively being included as part of the discussions with the clients. Results analysis Clients are looking for service organizations to provide cyber security assurance around the critical infrastructure. 79% of respondents indicated that security is seeing increased interest or demand for independent assurance from clients. This also corresponds to our survey results showing an increased growth in service providers obtaining SOC2 reports and ISO certifications. Page 18

19 Do you discuss the need for independent assurance reports with clients? What are the latest trends? (1/2) How often do you discuss your independent assurance approach with your clients? Annually More frequently Never When the clients asks about it 30% (37%) 19% (16%) 4% (6%) 46% (41%) Numbers in parentheses depict results from 2013 Due to rounding, data may not total 100%. When you discuss independent assurance with your clients, how often do you ask your independent auditor to be part of those meetings? As part of our standard scheduled presentations on independent assurance 15% 18% If the client asks them to attend and answer questions 38% 43% Never 36% 35% Not applicable we do not discuss independent assurance with our clients 5% 4% Other reasons¹ n/a 6% 1 Other reasons include: Whenever auditor expertise is required If specific insight into independent audit view is required 0% 10% 20% 30% 40% 50% Depending on background requests received Where needed and regularly in meeting Page 19

20 Do you discuss the need for independent assurance reports with clients? What are the latest trends? (2/2) Which of the following areas are seeing an increased interest in or demand for independent assurance from your clients? A slowdown in high growth rates is noticed in areas where the demand for independent assurance remains high, such as regulatory compliance. However, due to the introduction of the confidentiality and security area in 2015, we noticed a significant shift in growth rates toward security driven by data privacy, customer data losses and legislation related to security requirements. Processes not related to financial transaction (e.g., customer management) Regulatory compliance (e.g., financial market supervisory Authority) Cloud services Confidentiality Security Data integrity 14% 20% 40% 67% 27% 22% 51% Not a 2013 category of the survey Not a 2013 category of the survey 45% 59% 79% In 2015 respondents noticed an increased interest in and demand for independent assurance from their clients, particularly in the area of security. Availability or business continuity 60% 71% Data privacy 70% 59% 0% 20% 40% 60% 80% 100% *Respondents were allowed to select multiple areas Page 20

21 Survey results Are independent assurance reports reducing the overall costs of providing assurance? Page 21

22 Summary The majority of the respondents (70%) indicated that the typical client audit costs less than one week of effort. A large portion of the of respondents (41%) indicated that the total internal time providing assurance to clients was less than one month. In 2013, only 30% of respondents indicated they spend one month or less. Over two-thirds of respondents indicated that their impression was client audit requirements were increasing. Results analysis There appears to be a trend toward less internal time being spent on client assurance. This could be due to clients increasing their trust in the assurance reports provided by service providers, increased number of assurance reports provided by clients or better alignment by service providers with client demands. Another reason why less time is spent on client assurance could be because service organizations have more mature internal control environments. Page 22

23 Are independent assurance reports reducing the overall costs of providing assurance? (1/3) What is your impression of the trend in client audit requirements? How much effort is required from your organization to support a typical client audit, when they perform these? 74% 67% 30% 33% 27% 26% 29% 7% 3% Stable Increasing < 1 man day 1 man day to 3 man days 4 man days to 1 week 1 week to 1 month > 1 month The majority of the service providers (70%) indicate that the typical client audit costs less than one week of effort. Due to rounding, data may not total 100%. Page 23

24 Are independent assurance reports reducing the overall costs of providing assurance? (2/3) What is the total internal time spent each year providing assurance to clients (be that supporting client audits, or independent assurance, or a combination of both)? This is time spent both managing the audit(s) and the time spent by service delivery teams supporting the audits (answering questions, etc.) > One year 7% 15% Six months to one year 11% 15% One month to six months 37% 43% One week to one month 26% 35% < One week 4% 6% 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50% The number of service providers spending one month or less on providing assurance increased to 41% from 30% in Due to rounding, data may not total 100%. Page 24

25 Are independent assurance reports reducing the overall costs of providing assurance? (3/3) If you are providing independent assurance to clients, how much does this cost in terms of total annual audit fees? (19%) (12%) 13% (23%) 22% 30% (35%) 25% (12%) 10% < 25,000 25,000 50,000 50, , ,00k 500,000 > 500,000 Numbers in parentheses depict results from 2013 More that half of respondents (65%) stated that the costs involved in providing independent assurance to clients were below Based on the number of reports, complexity or organization and scoping variations, these amounts differ for each organization. Due to rounding, data may not total 100%. Page 25

26 Survey results Are independent assurance reports helping you manage the assurance process? Page 26

27 Summary Only 15% indicated that none of their contracts involved sub-service organizations (SSOs). In 2015 most respondents (74%) indicated that key SSOs were part of the independent assurance report less than half of the time. Just 33% of respondents indicated that their clients rely on the supplier management controls set out in their independent assurance report. Results analysis SSOs are used by many service organizations for outsourcing activities. Key SSOs are often not part of the independent assurance report provided. Clients are relying on supplier management controls set out in the independent assurance report that typically do not provide sufficient reliance. Page 27

28 Are independent assurance reports helping you manage the assurance process? (1/3) Who manages the independent assurance process for you? Other individual or team Account management or client handling Specific, dedicated project manager Accountmanagement or client handling Service delivery Quality assurance or quality management Compliance Internal audit 18% 20% 24% More than half of respondents (62%) stated the process is managed by quality assurance, compliance or internal audit. 2% 2% 7% 12% 16% 0% 10% 20% 30% How often does this individual or team contribute to your bid teams in terms of providing assurance materials or vetting the assurance promises made by the bid team? Involvement is mandated by our bid management process for bids over a certain amount When asked to do so by the bid team Never 17% 70% 10% A large potion of respondents (70%) indicated that managers of the independent assurance process were not proactively involved in the bid process. Increased communication between the bid teams and the assurance or compliance teams could improve understanding of the needs and contractual obligations, and the potential costs of promises about providing independent assurance. Page 28

29 Are independent assurance reports helping you manage the assurance process? (2/3) How much effort in FTEs is required to manage the independent assurance process? What is the ratio between automated and manually or semi-manually performed controls in your organization? 1 42% Automated controls are less than 20% 33% % Automated controls are 21% 50% 45% 4-5 6% Automated controls are 51% 80% 19% % Automated controls are greater than 80% 3% > 10 14% 0% 10% 20% 30% 40% 50% Most companies require an effort of one to three FTEs to manage the independent assurance process. 0% 20% 40% 60% A major part of the survey participants appears to recognize, that the level of control automation is important for efficient and effective service delivery. Almost half of the service organizations participating in this survey stated that they have automated 21% to 50% of their controls. Page 29

30 Are independent assurance reports helping you manage the assurance process? (3/3) What percentage of your contracts involve the use of SSOs? For contracts where an SSO is key to your service delivery, and independent assurance is provided to your clients, in what percentage of instances is the SSO part of that independent assurance? 14% 15% 0% (no involvement) <10% 5% 10% 30% 30% 50% 6% 50% 70% 70% 90% 26% 12% >90% 22% 16% 3% 7% 6% 13% 55% <10% 10% 30% 30% 50% 50% 70% 70% 90% >90% For contracts where an SSO is key to your service delivery and independent assurance is provided to your clients, but the SSO is not part of this assurance, how do your clients obtain assurance from the SSO? Other 15% Clients do not seem concerned about getting assurance over the SSO s activities Rely on your supplier management controls set out in your independent assurance report Do their own audit at the SSO 10% 12% 33% Receive independent assurance report from the SSO 30% 0% 5% 10% 15% 20% 25% 30% 35% Page 30

31 About EY EY SOC reporting practice Worldwide, EY continues to be an industry leader and standard setter for SOC reporting. We have been providing SOC reporting services for nearly 25 years. Our current SOCR clients deliver more than 1,150 reports in over 40 countries annually. We have been part of developing the new standard and we continue to participate in these new developments. Per the International Association of Outsourcing Professionals 2014 Global Outsourcing 100, EY is the preferred service audit provider for: 3 of the largest 10 outsourcers by number of employees 3 of the largest 10 outsourcers by revenue 3 of the 10 highest rated outsourcers Page 31

32 About EY EY SOC reporting contacts Herbert Engelbrecht EMEIA-GSA (Germany, Switzerland & Austria) Pascal Winkler Switzerland-GSA (Germany, Switzerland & Austria) Drazen Lukac Austria-GSA (Germany, Switzerland & Austria) Peter Willa FSO (Financial Services) Cécile Delhaye FSO (Financial Services) Dennis Houtekamer EMEIA-BeNe Badrinath Midthe India Claus Thaudahl Hansen Nordics Rune Vanvik Norway Mark Russell UK&I Mark de Bos FSO (Financial Services) Adam Thwaits Africa Milada Peskova CSE (Central & Southeast Europe) Christelle Kerspern FraMaLux Page 32

33 Appendix Acronyms SOCR SOC1 SOC2 SOC3 EMEIA Service organization controls reporting Report on service organization controls relevant to user entities internal control over financial reporting Report on service organization s non-financial reporting controls as it relates to security, availability, processing integrity, confidentiality and privacy (Trust Services criteria) Similar to SOC2, but the report can be distributed publicly and only reports if the entity has achieved the Trust Services criteria, rather than reporting detailed testing results. Europe, Middle East, India and Africa ISO International Organization for Standardization ISAE International Standard on Assurance Engagements SSO Sub-service organization Page 33

34 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com EYGM Limited. All Rights Reserved. EYG AU3111 BMC Agency BACS ED None This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice. ey.com