itpilot has renewed its ISAE 3402 and ISAE 3000 assurance reports
Every year, we have our processes and controls independently audited. We do this because we believe it is the right way to run an IT company that develops and manages other organisations’ business-critical systems and personal data.
We have had an ISAE 3402 assurance report since 2022 and have renewed it every year since. This means we can once again document that the controls covered by the report are not merely described on paper; they have also been examined in practice. ISAE 3000 is more recent for us. We obtained our first report last year as a natural extension of the work we already do on data protection and GDPR.
This year, we have renewed both reports. And it is precisely that annual renewal that gives them their weight. A single report shows what the auditor examined during a specific period. When that work is reviewed year after year, it also says something about how we run itpilot.
What do the two reports cover?
Our ISAE 3402 report concerns our internal controls for operations and development, including access management, change management and day-to-day operations.
Our ISAE 3000 report focuses on our work as a data processor with personal data, GDPR and data protection.
Both are Type 2 reports. This means the auditor assesses how the controls within scope are described and designed, and also examines how they have operated throughout the period covered by the report. Together, the reports give our customers insight into two important aspects of how we work.
What does this mean for you as a customer?
The short answer: you do not have to take our word for it. You can see what an independent auditor has examined and what they concluded.
In practical terms, you can use the reports as documentation when assessing us as a supplier. This might be for your auditor or GDPR lead, or in response to requirements from customers and business partners. Many organisations now face documentation requirements from several directions at once: customers, their parent company, insurers or public authorities. Having relevant documentation available from us can make that work easier.
“We sometimes meet prospective customers who specifically ask for a supplier with ISAE reports before they are even willing to take the conversation further. It is a sign that the market is maturing. But for us, this is about more than being able to show the right paperwork during a sales conversation. It is about fulfilling our responsibility when we operate and develop solutions for others. An IT supplier that handles other people’s systems and data has to take IT security seriously and have sound processes in place. The reports allow us to document that these are more than just words.”
Kenneth Brogaard Løwe, CEO, itpilot
More than a snapshot
Behind the reports lies practical, ongoing work. It is not enough to put policies and procedures in writing. We also need to show how they are followed in day-to-day work throughout the period the auditor examines.
"What makes a Type 2 report valuable is that the auditor does not just check whether we have written down the right things. They check whether we actually do them consistently, month after month. It is not something we simply obtain and put in a drawer. We have to live up to it throughout the entire period."
Emilie Anker, Project & digitalisation consultant, itpilot
Work that continues year after year
Renewing the reports every year is not news in itself. It is part of our routine. And that routine is exactly the point.
Do you have questions about what itpilot’s reports cover, or would you like access to them as part of your assessment of us as a supplier? You are always welcome to contact us. Call us on +45 87 25 07 87 or fill in the contact form
