[cabfpub] When is Baseline effective for audit

Sheehy, Don (CA - Toronto) dosheehy at deloitte.ca
Tue Nov 13 14:56:18 UTC 2012

Hi Ben:

As all are aware, WebTrust has published baseline audit guidance and ETSI will have their guidance very soon. As all are aware, the Baseline1.0  requirements were developed with an effective date of July 1. However, Tom Albertson has mentioned a few times that that he was not regarding the requirements as effective until the audit guidance is available which it now is. Also, at the NYC meeting at least 1 CA admitted that they were not compliant on July 1.

With all that being said, can the Forum agree on the effective date at which Baseline needs to be met.  That will then set the line in the sand for the start of that audit period. We can certainly go back to July 1 - that is no problem as long as the CAs have their evidence of compliance ( if not they would of course receive a qualified Baseline audit report).

This decision is needed as there are a number of CAs whose reporting period ends over the next 3-4 months. The expectation would be that they may also need to report on Baseline, depending on what date the forum ultimately chooses.


Donald E. Sheehy, CA*CISA, CRISC, CIPP/C
Partner | Enterprise Risk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20121113/2f9632c1/attachment-0003.html>

More information about the Public mailing list