Audit firms who have had prior engagements with CIIOs are not automatically perceived to be in a position of conflict of interest. The assessment of what constitutes conflict of interest would ultimately depend on the type of the prior engagement.
For example, audit firms that have previously provided CIIOs with consultancy or advisory services in relation to the design and implementation of the CII controls, maintenance of the CII, or processes and procedures relating to the CIIO’s compliance with its obligations under the Cybersecurity Act, are likely to be in a position of conflict of interest to conduct the cybersecurity audit.
CSA assesses auditor applications on a case-by-case basis, and on merit of the information submitted. CSA would also liaise with CIIOs to obtain further information regarding the prior engagement. CIIOs are advised to provide clear and detailed write-up(s) on the specifics of the prior engagements with the proposed auditors, to facilitate the application process.