Case study: SOC 2 Type 2 assurance for a leading Australasian technology services provider

After receiving an audit request from a government client, our client – a large systems integrator – sought an independent assurance partner capable of assessing a complex and mature technology environment against SOC 2 Type 2 requirements.

The organisation wanted an efficient, risk-based approach that would provide assurance to the client and other stakeholders, while supporting their ongoing commitment to security, privacy and operational excellence. 

A comprehensive assessment of controls

Leveraging multiple years of experience working with the client, our team independently assessed the design and operating effectiveness of controls across key Trust Services Criteria, including:

• Security
• Availability
• Confidentiality
• Privacy 
• Processing integrity

Our approach combined deep technical expertise with a practical understanding of their technology landscape to enable an efficient and value-driven assurance process.

Ashwin Pal, Partner in RSM’s Risk Advisory division and a specialist in privacy and security, says their team had supported the client through multiple SOC 2 assurance engagements in the past.

“Their environment is highly complex and technologically advanced. Our services were completely tailored to their unique operating environment and business objectives to enable a high-confidence outcome."

“When we have the opportunity to work with a client for repeated engagements such as these, it allows us to build a deep understanding of the client's business and control framework. This means we can work as efficiently as possible and deliver a seamless result.”

Trusted independent verification and greater confidence

Following the assessment, our client now has:

• Independent verification of the effectiveness of critical security and operational controls
• Enhanced confidence among clients, partners and stakeholders through a recognised assurance framework
• Demonstrated commitment to strong governance, operational resilience, and information security best practices.

“With a client of this size, you cannot go in with a script,” says Ashwin. 

“We were able to customise our approach to the way they operate to remove any friction from the audit. We worked with them in a way that worked for them, while maintaining strict independence. The result was a report that was immediately accepted by their client with no questions or comments.”