Schellman vs. Lower-Cost Providers

In the dynamic world of business, where compliance is becoming more important either as requested assurance from customers or a key market differentiator, more and more organizations are turning to assessment firms to help them communicate these advantages. And while some will always look at compliance in the most oversimplified, checkbox manner, many customers and regulators recognize good (and poor) quality of delivery.

It’s not enough to just undergo an assessment and present the results—you need the report you deliver to your customers to be accurate, reliable, and trustworthy. You want to deliver strong assurance to your customers and prospective partners that you can protect their data, but that means providing them with a strong compliance report from an assessor who did good work, which often means paying for that.

So while we know that—in the current market—it can be tempting to go with a firm that offers more cost savings, we feel it’s important to explain what you’d be getting when you do opt to use our services for what you may consider an elevated price point.

That’s why, in this blog post, we'll delve into some of the advantages Schellman offers as a potential assessment partner, as well as some of the risks of these lower-cost providers. At the end of the day, you’ll need to decide what aspects of compliance your organization wants to prioritize—that may very well remain cost savings, but at least you’ll have more information when making your final decision.

5 Things Schellman Offers as an Assessment Partner

We understand that these discussions are challenging no matter what. That being said, we believe that we offer competitive pricing that reflects the quality of our assessments and our assessment teams across the board.

Of course, you’ll be the judge of that after more detailed discussions with our team about your needs and how we can help, but as a precursor to those, here are some additional key attributes that set us apart:

1. An Excellent Reputation and Credibility

Schellman has been operating in compliance for over 20 years now, having built up a solid standing within our industry, despite still being a smaller, boutique firm, and your external stakeholders—such as investors, regulators, and customers—are likely to place higher trust in assessments from a reputable organization.

2. Exceptional Expertise and Experience

That aforementioned reputation was built on our expertise and experience—our auditors bring a wealth of experience and expertise to the table. From top to bottom, our auditors average the following experience:

• Principals (Engagement Leads): 20+ years
• Managers/Directors: 10.5 years
• Senior Associates: 2.8 years

All of our team members, regardless of current title, are well-versed in auditing standards, regulations, and best practices.

3. Independent and Unbiased Audit Thoroughness

Independence and objectivity are at the core of auditing—you’re investing time and money to get third-party validation, and our firm maintains strict ethical standards to ensure our assessments remain impartial and unbiased the way you need.

We also understand we can’t keep your business if we don’t deliver quality too—that’s why we leave no stone unturned in our work. Our inquiry, observation, and/or inspection testing is all tailored to best serve every individual organization we serve to ensure a meticulous assessment of the design and/or operating effectiveness of your particular controls.

4. Value-Added Insights

Our assessors don't just focus on the compliance project you’ve requested; using established industry-wide benchmarks, they’ll provide valuable insights throughout the engagement to help improve your operations.

5. Comprehensive Auditing Services

As the only CPA firm in the Top 100 that focuses solely on IT security and privacy, we aim to serve as the “one-stop shop” for our customers’ and prospects’ cybersecurity compliance objectives. Our suite of services includes:

• SOC examinations (SOC 1, SOC 2, etc.)
• ISO certifications (ISO 27001, ISO 22301, ISO 27701, etc.)
• Federal assessments (FedRAMP, CMMC, NIST 800-53, etc.)
• Payment card assessments (PCI DSS, etc.)
• Healthcare assessments (HITRUST, HIPAA, HDS, etc.)
• Cybersecurity assessments (penetration testing, cloud configuration, ransomware preparedness, software security, TISAX, etc.)
• Privacy assessments (GDPR, CCPA, MS DPR, etc.), and more.

To learn more about how we efficiently manage multiple projects for one client, check out our article on our single-provider methodology.

The Risks of a Lower-Cost Assessment Provider

Obviously, we are selling ourselves here and while all that probably sounds great at face value, you still have a budget to answer to, which may make a lower-cost provider more appealing.

If so, keep in mind the potential trade-offs you might be making for the sake of (theoretically) minimizing expenses:

• Limited Resources: Through offshoring work, overreliance on ‘automation’, etc., low-cost providers may cut corners to keep their own costs down.

• Inexperienced Staff: Low-cost providers may also employ less experienced or less adequately trained auditors who lack the expertise required to navigate complex compliance issues.

• Rushed Process: Low-cost providers might rush through the process to meet tight deadlines, opting to simply check the boxes.

• Minimal Interaction: Low-cost providers may limit their interaction with you to cut down on costs, and that could result in potentially missed red flags.

For further insight into the risks of lower-cost providers, read our more detailed article here.

Choosing Your Assessment Partner

Though Schellman can be considered a pricier option to some, we’ve worked hard to standardize our assessment excellence and build a reputation on our expertise, experience, precision, and versatility. Moreover, it’s important to remember that, in the realm of audit services, the saying "you get what you pay for" holds true.

While lower-cost providers might seem attractive from a budget perspective, there are potentially other compromises you may be making in engaging one—some that may have long-term consequences that outweigh the initial savings.

As you continue to weigh your options and determine your feasible priorities regarding your compliance projects and the subsequent assessment processes, read our other content that can help clarify even more:

• 5 Major Things to Consider When Selecting An Audit Firm
• 3 Questions to Ask Your Single-Provider Cybersecurity Firm
• 5 Steps to Help You Prepare For Your Compliance Audit