A growing number of companies have turned to outside service organizations to manage mission critical systems, store and process confidential business information, and process transactions. To identify and control privacy issues, or reputational risks, and to comply with regulatory requirements such as the Sarbanes-Oxley Act, clients of service organisations should consider performing a third-party audit of critical IT operations to help find evidence of effective controls.