Framework Assurance Reports
ISAE 3402
ISAE 3402 is the international assurance standard under which an independent accountant reports on the controls a service organization operates for its customers, where those controls could affect the customers' financial reporting. It was issued by the IAASB in December 2009 and applies to service auditor reports for periods ending on or after June 15, 2011.
It is the international counterpart of the US SOC 1 report, and many providers that serve customers in Europe, Asia and the Middle East ask for it by name.
The standard obliges the service organization to produce a written description of its system, a set of stated control objectives, the controls that meet each objective, and a signed management assertion that the description is fair and the controls are suitably designed (Type 1) and operated effectively across the period (Type 2).
The auditor tests against that description, so the documented processes, policies and control owners have to match what actually happens.
help
Who has to comply
Voluntary. Service organizations (payroll processors, fund administrators, hosting and SaaS providers, outsourcers) obtain it because customers and their financial statement auditors ask for evidence about outsourced controls. The trigger is contractual and commercial, not statutory.
What the assessor asks to see
System description and control objectives; management assertion letter; organization chart and control ownership; policies and procedures for each control area (change management, logical access, operations, incident handling); population lists for samples (new hires, terminations, changes, incidents, backups); evidence for each sampled item (tickets, approvals, access reviews, logs); subservice organization reports and complementary user entity controls; management's monitoring of controls and exceptions.
Assessors
Who assesses ISAE 3402
A professional accountant in public practice (a licensed audit or chartered accountancy firm) acting as the service auditor. In most countries this means a firm that is licensed to sign assurance reports under the local professional body and that follows the IAASB quality management standards.
Practitioners are regulated through national accountancy licensing and oversight bodies (for example public audit oversight boards and professional institutes) and must comply with ISQM 1 and the IESBA code.
No firm has claimed a ISAE 3402 assessor listing yet. Claim yours →
Consultants
Who helps with ISAE 3402
A readiness ecosystem exists: advisory firms and the consulting arms of accounting firms help draft the system description and control matrix, run gap assessments and mock testing, and prepare evidence. Typical engagement is a readiness project of a few months followed by an observation period and the audit itself.
Readiness consultants may not also sign the assurance report for the same entity.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
No firm has claimed a ISAE 3402 consultant listing yet. Claim yours →
Software
Tools for ISAE 3402
Tools that name this framework in their own material.
No firm has claimed a ISAE 3402 tool listing yet. Claim yours →
Related reading
- ISAE 3000 and ISAE 3402 explained: US equivalents and global relevanceMaps ISAE 3402 onto the American SOC 1 report and explains when a customer outside the US wants which one.Moore Kingston Smith
- The new US assurance standard SSAE 18A detailed comparison of the American and international service organization standards, including subservice organization monitoring.Compact (KPMG Netherlands)
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for ISAE 3402
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with ISAE 3402
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.