Question ID
2018_4152
Legal act
Directive 2015/2366/EU (PSD2)
Topic
Strong customer authentication and common and secure communication (incl. access)
Article
97
Paragraph
3
Subparagraph
N/A
COM Delegated or Implementing Acts/RTS/ITS/GLs/Recommendations
Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
Article/Paragraph
Article 3 Review of the security measures
Type of submitter
Accounting firm
Subject matter
Review of the security measures: Audit report
Question

Should the Audit for the implementation of the security measures be incorporated into an existing ISAE3402 report or COS3000 report or should a separate report be used?

If a separate report should be used: Are there any templates available for reporting?

Also, how detailed should the report be? Finally, should both design and operating effectiveness be tested of the requirements stated in the RTS articles?

Background on the question

Audit firms want to know when an audit report is of the adequate audit standard and has sufficient detailed information in order to be assessed by the national authority.

Based on the sentence: "This audit shall present an evaluation and report on the compliance of the payment service provider’s security measures with the requirements set out in this Regulation" it may suffice to state in the report that compliance is met or not. However, it would appear to be desirable that the report contains detailed information on compliancy per article of the RTS in case the specific article applies to the payment service provider that is being audited. And in case not each requirement is met, that the auditor assesses the risk of fraud or other unauthorized activities (such as data leakage or destruction).

Submission date
Final publishing date
Final answer

Article 3(3) of the Commission Delegated Regulation (EU) 2018/389 states that the “audit shall present an evaluation and report on the compliance of the payment service provider's security measures with the requirements set out in this Regulation”. This Regulation does not specify the format of the audit or the format or length of the audit report. If the payment service provider would like this audit to be conducted together with other audits on security measures, such an option is not excluded by the Regulation, provided that the auditors have “expertise in IT security and payments and be operationally independent within or from the payment service provider” and that they are conducted with the same frequency as foreseen in Article 3(2) of this Regulation. While the report may form part of a wider report, it should be extractable and isolated from the rest of any such report given the requirement in Article 3(3) for the report to be available to competent authorities upon request.

Status
Final Q&A
Answer prepared by
Answer prepared by the EBA.

Disclaimer

The Q&A refers to the provisions in force on the day of their publication. The EBA does not systematically review published Q&As following the amendment of legislative acts. Users of the Q&A tool should therefore check the date of publication of the Q&A and whether the provisions referred to in the answer remain the same.