01
Objective and timing
Agree whether the need is TrustGuard, IT material for KSB 315, training or AI implementation. Identify systems, participant roles, confidentiality rules and the target date.
For statutory auditors
IT support for statutory auditors
We support statutory auditors and audit firms in four areas: TrustGuard, KSB 315, training and AI implementation. We help protect firm documentation, prepare IT material for financial statement audits and improve team workflows. Audit assessments and professional decisions remain with the statutory auditor.
Trusted by
Companies and institutions that need stable IT.
Audit evidence or protection for the audit firm?
IT evidence for an audit and protection of an audit firm’s own environment have different scopes. We also support entities preparing IT material for their auditor. Before accepting work we establish the commissioning party and assess conflicts. We do not combine preparing an entity’s evidence with independently assessing that same work for its auditor in the same audit.
Four areas of support for audit firms
Choose the service that meets your firm’s needs. Each project has a separately agreed scope.
TrustGuard
Virtline’s own programme for protecting an audit firm’s data: documentation and control assessment, SILVER, GOLD and PLATINUM levels, a report and annual supervision.IT audit for KSB 315 purposes
Technical material for a financial statement audit: systems, general IT controls, application controls, report reliability, risks and recommendations.Training
Phishing, document confidentiality, data protection and incident procedures. Training tailored to the roles and work of the firm’s team.AI implementation
Process analysis, offline AI models, knowledge bases and document workflow automation. Data access and output review are agreed before a pilot.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity. The certificate concerns Virtline, not the audit firm’s compliance or an audit conclusion.
View Virtline’s certificateHow cooperation with Virtline runs
This is not a mandatory package or a process replacing a financial statement audit. With Virtline’s Krakow team, you choose the initial scope and the people responsible.
02
Scope and roles
We prepare a brief covering needs, constraints, expected material and information needed for pricing. We agree remote or on-site work and responsibilities across the audit firm, audited entity, IT and Virtline.
03
Evidence and explanations
We collect evidence within the chosen scope, identify gaps and discuss technical findings. Control owners provide and explain the material; the statutory auditor assesses its usefulness for the audit.
04
Actions and ongoing support
We agree the recommended next step, owners and acceptance criteria. This may involve a correction, implementation, TrustGuard, training or ongoing IT support. Further scope and reviews require separate agreement.
Practical scope
What we organise
We agree the material required with the audit firm and audited entity. Technical findings identify sources, gaps and owners so the auditor can use them in their assessment.
Enterprise resource planning (ERP), finance and accounting, HR and payroll, reporting, integrations and hosting. We describe IT dependencies relevant to financial data, critical systems and supplier responsibilities.
Material mapped to the agreed scope of KSB 315, ISO 27001, NIS2 or client requirements. Privileged accounts, granting and changing access, removing it when staff leave, MFA, periodic reviews and exceptions have identified control owners.
Access, change approvals, logs, monitoring, incidents, report generation and continuity. We include backup reports, retention and restore tests. We distinguish weaknesses in control design from problems with their operating effectiveness, and describe evidence limitations and technical explanations for the audit file.
Priorities, missing evidence, owners, deadlines, acceptance criteria and completion records. We identify management decisions and possible compensating controls: other measures that reduce the risk concerned. Immediate corrections are distinguished from projects and ongoing operations.
Training and AI implementation for audit firms
Training helps the team recognise phishing, protect documentation and respond to incidents. AI implementation starts by selecting a process and reviewing data confidentiality rules. Options include local models, internal knowledge search and automation of repetitive tasks. The pilot includes human review of output accuracy and document access rules. AI supports the team; responsibility for assessing materials and conclusions remains with the auditor.
IT and security services for audit firms
You can begin with a single area. Each service has a separately agreed scope.
-
IT outsourcing
Ongoing support for laptops, email, Microsoft 365, user requests and documentation of your firm’s IT environment.
-
Security training
Phishing, client document confidentiality, data protection, remote work and incident procedures for your team.
-
Backup and data recovery
Document and system backups, retention rules, restore tests and reports for review.
-
Multi-factor authentication
Additional sign-in verification for email, financial systems, administrative accounts and remote access.
-
Cybersecurity
Risk assessment and safeguards for devices, email and networks, with monitoring and response procedures.
Questions about support for audit firms
Is the offer only for audit firms?
+
It is primarily for statutory auditors and audit firms. We also support audited entities preparing IT answers, evidence and follow-up actions, and organisations handling confidential client documents. We match scope to the commissioning organisation’s role.
Where should we start: KSB 315 or TrustGuard?
+
If the priority is IT material for a financial statement audit, KSB 315 support is the starting point. If your firm’s own security is the concern, you can start with TrustGuard or a review of specific safeguards. TrustGuard is Virtline’s own programme, not a financial statement audit opinion or ISO certification. Choosing a route does not guarantee a level or certificate.
Does AI make decisions for the statutory auditor?
+
No. AI implementation can improve information retrieval and repetitive work. Outputs require human verification. Evidence assessment, professional judgement and audit conclusions remain with the statutory auditor.
Can we arrange ongoing IT support after the project?
+
Yes, under a separately agreed scope. We can move to helpdesk support, Microsoft 365 administration, backups, MFA, monitoring, access reviews and reporting. You can also begin with training, a backup review or email improvements without commissioning the whole offer. Training helps reduce risk but does not remove it on its own or establish the firm’s compliance.
Start with the objective and deadline
Tell us whether you need TrustGuard, KSB 315 support, training or AI implementation. Describe the objective, timing and team needs. Do not submit passwords or confidential audit files through the form.
Discuss your firm’s needs