Finding and engaging the right auditor for your C5 attestation

This page helps you choose the auditor for a BSI C5 attestation. How the audit then runs and how you plan backwards from your customer deadline is covered on C5 audit process; what the report tells your customers, on C5 attestation.

Does the C5 auditor have to be a public auditor (Wirtschaftsprüfer)?

Under the catalogue, not necessarily; under the BSI FAQ, yes. The two BSI sources differ on this point, and you should know both when you choose.

• C5:2026 catalogue: It requires an engagement under ISAE 3000 (Revised) or a national equivalent and expressly provides for the case that the auditor is not a public auditor or a public audit firm (Wirtschaftsprüfungsgesellschaft). The report must then identify the professional requirements, or requirements in law or regulation, applied that are “at least as demanding as the IESBA Code and ISQM 1” (section 3.4.13, item 1.3).
• BSI FAQ: The German-language FAQ states that under the applicable regulations only Wirtschaftsprüfer can issue a C5 attestation, and elsewhere that a report without the signature of a Wirtschaftsprüfer does not conform to C5. According to the FAQ, other specialists may work in the audit team.

In practice, this means: ask your most important customers whether they expect a report from a public auditor or a public audit firm. If they do, the question is settled for you. If you sell internationally and are considering an auditor from another country, clarify your German customers’ requirement in writing before you engage one.

ISAE 3000 and IDW PS 860: what the standard means for your audit

Every C5 audit is based on ISAE 3000 (Revised), the international standard for assurance engagements other than audits or reviews of historical financial information. According to the catalogue, the German audit standard IDW PS 860 “IT-Prüfung außerhalb der Abschlussprüfung” (IT audits outside the audit of financial statements) of the Institut der Wirtschaftsprüfer (IDW, Institute of Public Auditors in Germany) is in line with ISAE 3000 (Revised) and can be used equally, as can other national equivalents (section 3.2). The text of IDW PS 860 is not freely available; for your choice it is enough to know which standard the auditor relies on and that the report states it.

This helps with one point in particular when you choose: if a firm already audits your SOC 2 report, it does so under AICPA standards. Have it confirm which of the standards above the C5 audit relies on; how SOC 2 and C5 otherwise complement each other is shown on C5 vs SOC 2.

What qualifications does the catalogue require of the audit team?

The requirement applies to the members of the audit team who supervise the execution and review the results of the engagement, not to every person who looks at evidence (section 3.4.2). Under the German version 1.1.0, they must meet one of the following:

• at least three years of relevant professional experience with IT audits under the relevant ISAE standards, or
• one of these professional examinations or certifications: CISA, CISM or CRISC (ISACA); ISO/IEC 27001 Lead Auditor or BSI certified ISO 27001 auditor for audits based on IT-Grundschutz; CCSK (Cloud Security Alliance); CCSP or CISSP ((ISC)²).

Three points from the same section are useful to you as the client. Before accepting the engagement, the auditor checks their professional duties including independence, in Germany under Section 43 WPO (Wirtschaftsprüferordnung, the German law regulating the profession of Wirtschaftsprüfer), and assesses whether the team brings the necessary competence, understanding of the industry and experience. At your request, the auditor must provide evidence that the team meets the requirements. And the final report confirms compliance in the section “Independence and Quality Management”, which your customers can read.

You should know about two discrepancies: the English version 1.0.1 requires the three years of professional experience “in a public audit firm”, while the German version refers to IT audits under the ISAE standards. And the BSI FAQ mentions that at least half of the team must hold certain qualifications; section 3.4.2 of C5:2026 does not say this. Clarify with the auditor which catalogue version they use to confirm the qualification.

Advisory work and audit: why the two stay separate

Whoever helped design your controls or wrote your system description should not audit them. The catalogue requires an independent auditor who checks their independence before the engagement (section 3.4.2) and states in the report that they comply with the independence requirements of the IESBA Code, which is founded on principles including integrity and objectivity (section 3.4.13, item 1.3). For Wirtschaftsprüfer in Germany, Section 43(1) WPO also applies: they practise their profession “independently, conscientiously, confidentially and on their own responsibility” (our translation) and must be impartial when issuing audit reports.

Whether a particular advisory service puts independence at risk is assessed by the auditor under their professional rules, not by the consultant. So tell the auditor early who is supporting your preparation and to what extent. The BSI FAQ points to a further tension: the provider engages and pays the auditor, and the BSI does not review the reports, so the critical evaluation of the report lies with the customers. In our assessment, your report is worth more to customers when the auditor’s independence is visible to them.

Blackfort Technology has no partnership with any audit firm. You choose the auditor; we help you make quotes comparable on the same basis.

When to approach the auditor

Our recommendation: before a type 2 audit period starts, ideally during implementation. According to the BSI FAQ, the provider sets the planning and period of the audit itself and agrees them with the auditor; the independence check before acceptance also takes time. How this fits into a schedule up to your customer deadline is shown in the backward planning; which details an auditor needs for a quote is on C5 attestation costs.

Questions for choosing an auditor

The following questions are our recommendation for talks with potential auditors. The right-hand column gives the reference in the catalogue or the BSI FAQ so that you can put the answers in context.

Example: three quotes for a learning platform

Fictitious example, not a client. A provider of a learning platform for universities, run as SaaS on a public cloud platform in Germany, wants a first type 2 report under C5:2026. Based on the same scope sheet, it obtains three quotes:

• Auditor A, a public audit firm with its own IT audit team, audits under IDW PS 860 and reports in German.
• Auditor B, also a public audit firm, already audits the provider’s SOC 2 report and offers a coordinated audit with joint evidence collection, with the report in English and a German version.
• Auditor C, an audit firm from abroad without admission as Wirtschaftsprüfer in Germany, audits under a national equivalent to ISAE 3000 (Revised).

The provider first asks its two largest university customers. One of them expressly requires a report from a public audit firm, which rules out C. Between A and B, the answers to the questions above decide: both demonstrate the qualification under 3.4.2, B saves duplicate evidence through the alignment with SOC 2, and A has capacity earlier in the desired period. The choice falls on B because the customer deadline allows the later start.