a) Procedures the External Auditor would need to perform to evaluate the effectiveness of Abbey Ltd’s data security controls:

1. Review of Policies and Procedures: Examine the company’s policies and procedures related to data security, including access control and incident response policies, to ensure they are up-to-date and aligned with industry standards.
2. Interviews with Management and Staff: Conduct interviews with key personnel to understand roles and responsibilities regarding data security and inquire about any past breaches or incidents.
3. Review of System Logs: Examine system logs to assess whether the company’s systems are functioning as intended and to identify any vulnerabilities or unusual activity.
4. Testing of Controls: Perform tests on the data security controls, such as penetration testing, to determine if the company’s network and applications are adequately protected.
5. Review of Third-Party Contracts: Inspect contracts with third-party vendors to ensure that appropriate data security provisions are in place for any data shared or accessed by external parties.