Compliance-Nachweise bei Outsourcing von IT-Aufgaben

Abstract

Information and communication systems become more and more relevant in proving compliance with different types of regulations, e.g. the Sarbanes-Oxley Act. In the case of outsourcing, auditing procedures may reach beyond the boundaries of the company. ,,SAS 70 reports" can be used to document the compliance of service providers. Due to different legal systems and awareness, the auditing of service providers may become tedious especially in the case of offshoring or nearshoring. Proofing compliance becomes difficult if several service providers are employed or if the service provider employs subservice providers. One advantage of outsourcing compliance-relevant tasks is that the proof of compliance is (partially) delegated to another company. However, for providing this evidence the service provider will charge costs and the quality of the confirmation may not be accepted by the auditor of the company which is outsourcing IT tasks. Therefore it is not clear whether the accentuated regulations favor or inhibit the outsourcing bandwagon.