Hi Selina,

Great question! You’re right that they both focus on the client‘s IT systems and potential risks, but there’s a difference in their purpose and what we actually look to achieve.

Tech Risk Assurance is part of Assurance (I.e. audit). As auditors, we want to be able to give an opinion on whether the financial statements are materially correct, or whether we believe anything is significantly wrong. Part of this involves looking at an entity’s IT systems and controls. For example, if we want to test payroll costs, and do this by receiving a payroll report from the client’s system, we need to know we can rely on that system. That’s where Tech Risk Assurance comes in - you would be responsible for testing the controls and the IT system, and communicating to the financial audit team whether they can rely on it for their testing.

Tech Risk Consulting obviously also focuses on technology risk, but with a different end goal. In assurance, we’re mainly focused on whether the financial statements are true and fair. In consulting, you’re more looking to advise your client on where there could be weaknesses in their system, potential risks they face (such as cybersecurity threats), helping to design effective controls and processes, etc. If it helps, think of audit as marking a client’s work, and consulting as helping the client to prepare their work.

It might sound like a small difference, but it’s really important for the work we do - as an auditor, it would be hugely inappropriate to test a control that we have helped a client design as we might not want to admit we’ve got it wrong! So keeping a clear division between assurance and consulting means we can be sure we’re providing our clients with the best possible service while still remaining objective and fair.

21 August, 2025 09:49