[Educational Event] SOC & ISAE Reports: Benefits, Limitations & Practical Uses

With over 20 years of experience in IT Audit, Information Security, and Revenue Assurance, Sandro is a Computer Science and Artificial Intelligence (CSAI) graduate and a Certified Information Systems Auditor (CISA) since 2007.

He joined Deloitte Malta in 2016 and leads IT audit engagements supporting statutory audits for national and international organisations. Sandro specialises in assessing the design, implementation and operating effectiveness of IT controls that mitigate risks to financial reporting, data integrity, and regulatory compliance, particularly within the online gambling and financial services sectors.

He leads Deloitte Malta’s IT audit quality approach and technology focused third-party assurance engagements under the ISAE 3402 and ISAE 3000 frameworks.

In today’s interconnected business environment, trust is fundamental. SOC (System and Organization Controls) and ISAE (International Standard on Assurance Engagements) reports emerged as the benchmark standard for demonstrating control maturity to clients, auditors, and regulators—without the burden of repetitive audits.

Whether you are a service organization seeking competitive differentiation, an enterprise assessing vendor security, an auditor utilizing these reports, or a compliance professional managing regulatory requirement, an understanding of SOC and ISAE frameworks is indispensable.

The presentation will explore the fundamental concepts and different report types, comparing SOC (US-focused) and ISAE (international) standards, and highlighting both the real benefits and the practical limitations of third-party assurance. We will be also discussing how leading organisations use these frameworks to reduce audit fatigue, strengthen stakeholder trust, and support sustainable growth.