Technology Risk

We offer assurance technology assessment and attestation services, fostering audit quality and instilling confidence and trust in the adoption and implementation of emerging technology.

As companies accelerate the adoption of technology solutions in all aspects of their business, specialized knowledge of IT is integral to the execution of high-quality audits and the need to safeguard internal controls.

In Technology Risk, we assist in assessing risks, identifying gaps, mitigating audit risk and enhancing technology-related investments in support of a financial statement audit, audit of internal controls over financial reporting, System and Organization Controls Reporting and other forms of attestation services.

These services enable companies to navigate digital complexities with confidence, making informed decisions for their business while promoting trust in the capital markets.

How EY can help

The execution of high-quality information technology (IT) audit procedures and IT business processes in support of a financial statement audit and audit of internal controls over financial reporting creates the foundation of our commitment to protecting investors and the broader economy.

IT Audit services include:

Integrated audit
Financial statement audit
An independent assessment is undertaken to test management’s assertion over business processes and controls in the IT audit environment and to test business process and controls against specific attestation and agreed-upon procedures (AUP) standards. We also assess internal controls around security, privacy, confidentiality, availability and processing integrity.

Attestation services include:

System and Organization Controls Reporting (SOCR):
SOC 1, SOC 2 and SOC 3
SOC for Supply Chain/Cyber

Agreed-Upon Procedures (AUP) Examination Reporting
Digital Services Act (DSA) and Digital Markets Act (DMA) certification
International Organization for Standardization (ISO) certification
Cybersecurity Maturity Model Certification (CMMC)
SWIFT certification
Heath Information Trust Alliance (HITRUST) certification
Trusted Information Security Assessment Exchange (TISAX) assessment
Performance audits
For companies continuing to invest in technology, it is essential to fully understand IT process risks and to proactively identify potential internal control gaps prior to a system upgrade or implementation.

IT pre- and post-upgrade and implementation assessment services include:

Enterprise Resource Planning (ERP) assessments
Consolidation tool assessments
Governance, Risk, Compliance (GRC) program readiness
The rapid advancement of technology, coupled with an exponential rise in cyber threats, increases risk exposure to technology infrastructure.

EY teams can help identify the ways in which cybersecurity risks can impact IT audit processes, including financial reporting, business procedures and internal controls.

Technology risk cybersecurity services include:

Cybersecurity program assessments
Incident response tabletop simulations
Breach response and analysis assessments
Cybersecurity disclosure reporting support
Vulnerability assessments
Investors, regulators and society at large are demanding more transparency on nonfinancial performance, especially regarding ESG issues.

Technology Risk ESG services include:

Internal controls pre-assessment
Evaluations of non-financial systems implementation
Data pre-assessments
Gap analysis
Peer benchmarking analysis

Assurance services

Assurance teams serve the public interest by promoting trust and confidence in business and the capital markets.

Our latest thinking

Technology assurance: assess risk, build trust and create resilience

Three actions to build confidence, transparency and resiliency while managing technology risk now and into the future. Read more.

Daryl Box + 2

Transforming compliance with advanced strategies and technologies

Learn how multinationals are approaching compliance challenges and driving advancements. Read the 2024 Global Integrity Report – US edition.

Liban Jama + 1

Strategic AI integration, governance and risk in finance

Businesses are preparing to incorporate AI into the finance function and anticipating how to manage risks. Read more.

Natalie Jaros

How boards can embrace and oversee AI with curiosity and care

Lessons from the 2024 EY Board Strategy Summit: Board oversight of AI from

Ted Acosta, II + 1

The team

Daryl Box

EY Americas Assurance Technology Risk Leader

Driven leader. Champion of quality. Mentor. Husband and father.

Houston, USA

Jim Okas

EY Americas Assurance Deputy Technology Risk Leader

Growth-oriented leader. Prioritizes quality and collaboration. Dedicated relationship builder. Mentor. Advocate for diversity. Devoted father and husband.

Iselin, USA

On the agenda (5)

Skip

west

CFO Agenda

Featured: How can CFOs uncover the material among the immaterial

Discover

EY Center for Board Matters

Featured: What audit committees are reporting to shareholders

Discover

Public policy

Featured: US public policy spotlight: the AI landscape in the states

Discover

AccountingLink

Discover

ESG Reporting

Featured: What companies need to know about materiality for global ESG reporting

Discover

east

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.

Insights

Trending topics

Spotlight

Services

Spotlight

Careers

Spotlight

Industries

Case studies

About us

Top news

Technology Risk

How EY can help

Our latest thinking

The team

Daryl Box

Jim Okas

Insights

Trending topics

Spotlight

Services

Spotlight

Careers

Spotlight

Industries

Case studies

About us

Top news

Technology Risk

How EY can help

IT Audit procedures

System and Organization Controls Reporting and Attestation Services

IT system upgrades and implementation assessments

Cybersecurity

Environmental, social and governance (ESG)

Our latest thinking

The team

Daryl Box

Jim Okas