There are two main criteria that the proposed audit firm/team and auditors need to fulfil: (a) independence; and (b) competency. The appointed audit firm/team and auditors:

a. Should not be in a position of any conflict of interest, whether actual, potential or perceived. A conflict of interest refers to any circumstance where the auditor’s interests may potentially interfere with the independent and objective performance of his/her duties as an auditor; and
b. Should possess the necessary technical competencies (i.e. professional qualifications/certifications, skills, knowledge and relevant experiences) to perform the audits.

Audit firms who have had prior engagements with CIIOs are not automatically perceived to be in a position of conflict of interest. The assessment of what constitutes conflict of interest would ultimately depend on the type of the prior engagement.

For example, audit firms that have previously provided CIIOs with consultancy or advisory services in relation to the design and implementation of the CII controls, maintenance of the CII, or processes and procedures relating to the CIIO’s compliance with its obligations under the Cybersecurity Act, are likely to be in a position of conflict of interest to conduct the cybersecurity audit.

CSA assesses auditor applications on a case-by-case basis, and on merit of the information submitted. CSA would also liaise with CIIOs to obtain further information regarding the prior engagement. CIIOs are advised to provide clear and detailed write-up(s) on the specifics of the prior engagements with the proposed auditors, to facilitate the application process. 

CIIOs should re-submit a fresh application for another proposed auditor as soon as practicably possible. Alternatively, CIIOs could consider shortlisting and proposing a few auditors at the onset for the Commissioner’s approval in the event that the initial auditor choice is rejected. 

CSA assesses the “independence” criteria at both the individual auditor and audit firm levels. If an audit firm had previously provided the CIIO with consultancy or advisory services in relation to the design and implementation of the CII controls, maintenance of the CII, or processes and procedures relating to the CIIO’s compliance with its obligations under the Cybersecurity Act, the audit firm would likely to be in a position of conflict of interest to conduct the upcoming cybersecurity audit of the CII, even though another team from the firm is proposed to carry out the audit. 

CSA assesses the competency of auditors based on their professional qualifications / certifications, experience and training, on a holistic basis. While CSA is prepared to exercise some flexibility in assessing the auditors’ competency, it is generally advisable for auditors to possess recognised certifications such as CISA and CISSP. 

The condition of not having undertaken more than six consecutive years of audit work for the same CIIOs and CIIs, applies to external audit firms, internal audit department and the individual auditor.

For the avoidance of doubt, any break of 12 or more consecutive months in audit period will reset the calculation of the six consecutive years. To illustrate this, if an internal audit department had conducted audit work for CII A1 for CIIO A for 6 consecutive years of audit period following the date of designation of CII A1, a break of at least 12 continuous months of audit period would be required before the internal audit department’s application to undertake further audit work on CII A1 for CIIO A can be considered. During the break, CIIO A should engage external audit firm(s) to conduct the further audit work on CII A1 for at least 12 continuous months of audit period.

Similarly, if an external audit firm had conducted audit work for CII A1 for CIIO A for 6 consecutive years of audit period following the date of designation of CII A1, a break of at least 12 continuous months of audit period would be required before the external audit firm’s application to undertake further audit work on CII A1 for CIIO A can be considered. During the break, CIIO A should engage another external audit firm or have its internal audit team conduct the audit work on CII A1