Last updated: 2026-11-01
Besides the system description, the usual C5 audit needs a second document from management. This page explains what it contains, what it is based on and who signs it. How the system description itself is written is shown on C5 system description; which components the final report has is shown on C5 attestation.
What is the management statement in C5?
The management statement is the written statement by the cloud service provider’s management on the system description and the design of the controls. The English version of the catalogue calls it “Management Statement”; the German version calls it “Erklärung der gesetzlichen Vertreter” (statement of the legal representatives) (section 3.4.5.2). In an attestation engagement the audit is based on this document (section 3.4.4), and it appears in the report as the second component, after the auditor’s report (section 3.4.13).
In a direct engagement it is omitted together with the system description (section 3.4.13). The auditor’s report states explicitly that the cloud service provider is responsible for preparing the description and the statement, including completeness, accuracy and method of presentation (section 3.4.13, no. 1.2).
What does management confirm?
Two things, to the best of their knowledge and belief: that the description fairly presents the system, and that the controls stated in it were suitably designed to meet the applicable criteria, if they operated effectively. The catalogue also names three criteria to be used in making the statement; the third applies to type 2 only (section 3.4.5.2).
| Type 1 | Type 2 | |
|---|---|---|
| Confirmation 1 | The description fairly presents the system as designed and implemented as of the specified date | the same throughout the period |
| Confirmation 2 | The controls were suitably designed as of the specified date | The controls were suitably designed throughout the period |
| Criterion: risks | The risks that threaten the applicable criteria from being met have been identified. | |
| Criterion: controls | The controls described would address these risks if they operated effectively. | |
| Criterion: effectiveness | not applicable | The controls operated effectively throughout the period. Test applied: they were “consistently applied as designed”, including manual controls applied by individuals “who have the appropriate competence and authority”. |
The table summarises the catalogue in our own words; the wording of section 3.4.5.2 governs. In addition, section 3.4.4 describes the statement for type 2 as covering the operating effectiveness of the controls throughout the period as well, which matches the third criterion. In practice this means: management confirms assertions about the same matters the auditor assesses. If operations deviate from the description, both documents are affected.
On what basis does management make the statement?
On its own reasonable basis. The catalogue states explicitly that the fact that the auditor will report on operating effectiveness is not a substitute for the provider’s own processes (section 3.4.5.2). For type 2, the statement may be based on the provider’s monitoring activities regarding the effectiveness of controls over time. According to the catalogue, this involves identifying deficiencies, reporting them to the appropriate individuals and taking corrective action. Monitoring can be ongoing, through separate evaluations or both; internal auditors or personnel performing similar functions may contribute, as may information from external parties such as customer complaints and regulator comments.
What that can look like in practice is shown in the following list. It is our recommendation, not a catalogue requirement.
| Basis | Example | Who provides it |
|---|---|---|
| ongoing monitoring | monthly review of the evidence register: evidence due has arrived, gaps reported, actions tracked | information security management |
| separate evaluation | internal sample tests of selected controls before the end of the period, with documented results | internal audit or a person not responsible for the tested control |
| events and changes | list of the incidents and changes reviewed in the period, see changes and events | incident and change management |
| information from outside | customer complaints, security reports from customers, comments from authorities, review of subservice organisation reports | customer support, information security management |
| report to management | summary before signing: open deviations, actions, assessment for each criterion with a finding | information security officer |
These documents also help in the audit: if the auditor finds a deviation, one of the things the auditor assesses is whether the provider’s monitoring identified it and what corrective actions followed (section 3.4.12).
Who signs the management statement?
According to the catalogue, the management of the cloud service provider; the German version calls them the legal representatives (gesetzliche Vertreter). Who the legal representatives are is a matter of company law: in a German GmbH the managing directors represent the company (Section 35(1) GmbHG), in a German stock corporation the management board (Section 78(1) AktG). If several managing directors are appointed, they represent the GmbH jointly unless the articles of association provide otherwise (Section 35(2) GmbHG). For other legal forms and for companies under foreign law, their own rules of representation apply.
Our recommendation, expressly general information and not legal advice:
- Have the statement signed in line with the power of representation entered in the commercial register, and agree the signing arrangement with the auditor early.
- If the information security officer is not one of the legal representatives, their signature alone does not match the wording of the catalogue. They can prepare the statement; management should sign it.
- In groups, first clarify which company is the cloud service provider in the report. Its representatives make the statement.
When to sign is not set by the catalogue. Our recommendation: sign once the system description is in its final version, that is, after the audit procedures are completed and all additions resulting from the audit have been incorporated. Agree the date with the auditor. Each case needs a legal assessment.
What applies to periods over twelve months?
The type 2 period should not cover more than twelve months; in exceptional cases it may be longer, for example to better align with other audits, and a consistent period is recommended (section 3.4.4). If the management statement covers a period of more than twelve months, management has to state the reason for this (section 3.4.5.2).
The reason belongs in the statement itself and should be specific. A sentence such as “for organisational reasons” explains nothing. Better is a sentence that names the occasion and the future cycle, as in the example below. How long the period should be is covered on type 1 or type 2.
Sample structure of a management statement
Fictitious example, not a client. A GmbH with two managing directors runs a SaaS solution for route planning and care documentation for home care services. It has a type 2 report prepared for the period 1 October 2027 to 31 December 2028, that is, 15 months, in order to move to the calendar year from then on. Because the period starts after 1 June 2027, C5:2026 applies (section 3.5).
The structure is our recommendation. For the confirmations and criteria it refers to section 3.4.5.2 instead of rewriting the catalogue; agree the exact wording with the auditor.
| Part | Content | In the example |
|---|---|---|
| 1 Heading | company, service and regions, report type, specified date or period, catalogue revision | “Statement by the management of Example Care Software GmbH on the service ‘Routes and Records’, data centre region Germany, type 2 report for the period 1 October 2027 to 31 December 2028, criteria under BSI C5:2026” |
| 2 Reference | reference to the attached system description with version and date | “System description in the version of …” |
| 3 Confirmations | the two confirmations under section 3.4.5.2, related to the period | following the wording of the catalogue, agreed with the auditor |
| 4 Criteria | the three criteria under section 3.4.5.2, the third because of type 2 | following the wording of the catalogue |
| 5 Reason for more than twelve months | occasion and future cycle | “The period covers 15 months because from 2029 we are aligning the audit with the calendar year and thus with our other annual audits. Future periods will cover twelve months.” |
| 6 Signature | place, date, names and function of the legal representatives | “Cologne, [date], [name], managing director; [name], managing director” |
Company name, service and place are invented. The outline of the system description that part 2 refers to is available as a template on templates.
Typical gaps in the management statement
| Possible gap | Cause | Effect | Remedy |
|---|---|---|---|
| No basis of its own | Management relies on the auditor’s result | Statement without the basis the catalogue expressly requires; deficiencies only surface in the audit | plan ongoing monitoring and a separate evaluation before the end of the period, report to management before signing |
| Wrong signatories | The information security officer signs alone | Statement does not match the wording “management” (German version: “gesetzliche Vertreter”), the auditor’s follow-up questions cost time | base it on the representation rules in the commercial register, agree with the auditor early |
| Reason for a long period missing | Period of 13 months or more chosen, statement copied from the previous year | Mandatory information under section 3.4.5.2 missing | check the period length in every audit and state the reason specifically |
| Statement does not match the description | Statement signed before the last version of the system description | Management confirms a version that is not in the report | name the version and date of the description in the statement, sign only after the final version |
Frequently asked questions
Is the management statement the same as the system description?+
Does a type 1 report also need a management statement?+
Can the auditor word the management statement for us?+
What happens if the auditor finds deviations that management did not know about?+
Does every managing director have to sign?+
Read more
- C5 system description: minimum content, structure and example
- C5 significant events and changes in a type 2 report
- C5 documentation: keeping an evidence register for the audit
- C5 attestation vs C5 certification: report and meaning
- C5 type 2 or type 1 report: differences, period, choice
- BSI C5 audit process: steps, audit standards and timeline
Sources
- BSI: Kriterienkatalog Cloud Computing C5:2026, version 1.1.0 (PDF, German), sections 3.4.4.1, 3.4.5.2, 3.4.12 and 3.4.13, licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
- BSI: Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1 (PDF), sections 3.4.4, 3.4.5.2, 3.4.12 and 3.4.13, licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
- Section 35 GmbHG, representation of the company (German Limited Liability Companies Act, gesetze-im-internet.de, German) (retrieved 2026-11-01)
- Section 78 AktG, representation (German Stock Corporation Act, gesetze-im-internet.de, German) (retrieved 2026-11-01)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).