Quality and security
Built to pass your quality partner and your IT partner
Three layers of review before delivery, controlled access to your systems, and independence handled formally.
Quality assurance
Three layers of review before work reaches you
The objection we hear most is review burden. This is how we remove it.
01
Preparer
The seconded professional completes assigned sections to your documentation standard and signs a self-review checklist.
02
Icon in-house review
An Icon audit manager reviews testing logic, sampling, referencing and tie-outs before anything is shared.
03
Quality assurance check
A senior reviewer performs a risk-based sweep of high-risk areas and tracks findings to closure.
What we measure
Review notes per section
Tracked and trended for each person.
On-time delivery
Against agreed engagement milestones.
Rework rate
Sections returned for re-performance.
Partner satisfaction
Formal feedback each engagement cycle.
Information security
Built to survive your due diligence
ISO 27001 certified ISMS
An independently certified information security management system, subject to surveillance audit.
Controlled delivery hubs
Work is performed from secure, access-controlled facilities.
No local data retention
Virtual desktop delivery, disabled local storage, blocked removable media and restricted printing.
Access governance
Multi-factor sign-in, least-privilege access, named-user accounts and full audit logging.
Personnel controls
Background verification, signed confidentiality undertakings and annual security training.
Contractual protections
Firm-level NDA and data processing terms, defined breach notification and no subcontracting.
Governance
Independence, confidentiality and regulatory alignment
The questions your quality partner will ask, answered up front.
Your firm retains the engagement
Icon performs support procedures only. You direct the work, review it, form the conclusions and sign the report.
Independence management
Annual and engagement-level independence confirmations from every person, with conflict screening against your restricted-entity list.
Client notification support
We provide the documentation your firm needs where the use of an outside service provider must be disclosed to clients.
Documentation and audit trail
Supervision, review and sign-off are evidenced in your file so the arrangement stands up to peer review.
Cross-border data handling
Data residency and transfer terms agreed in advance.
No subcontracting
Your work is performed by our assigned personnel only and is not pooled with other clients’ teams.
Firms should confirm their own obligations under AICPA, PCAOB and applicable state board rules. Icon supports compliance; it does not replace your firm’s own independence assessment.
Secure your capacity before the next season
Book a 30-minute scoping call. We come back with a costed deployment plan within five business days.