Information Security Audit and ISO27001
ISO/IEC 27001:2005 covers all types of organizations (e.g. commercial enterprises, government agencies, not-for profit organizations). ISO/IEC 27001:2005 specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization's overall business risks. It specifies requirements for the implementation of security controls customized to the needs of individual organizations or parts thereof.

ISO/IEC 27001:2005 is designed to ensure the selection of adequate and proportionate security controls that protect information assets and give confidence to interested parties.

Statement on Auditing Standards No. 70: Service Organizations (SAS 70)
The Statement on Auditing Standards (SAS) No. 70, Service Organizations, is an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants. SAS 70, as amended by the AICPA on 1 May 2004, addresses the effect that a service organization may have on its client's financial reporting objectives. CICA 5970 is the Canadian version of SAS 70. SAS No. 70 is generally applicable when an auditor is auditing the financial statements of a user organization that obtains services from another organization, or service provider. These service providers could be application service providers, bank trust departments, claims processing centres, Internet data centres, or other data processing service bureaus.