Type 2 Reports | ISAE 3402

An ISAE 3402 Type 2 Report is known as the “Report on the description, design and operating effectiveness of controls at a service organization. 

At a minimum, the ISAE 3402 Type 2 report will need to include the following content:

• A description of the service organizations "system".
• A written assertion from the service organization that fairly presents the service organization's system as designed and implemented throughout the specified period and that the controls related to the control objectives stated in the description of the "system" for the service organization were suitably designed throughout the specified period. Additionally, that the controls related to the control objectives, as described in the service organization's description of its "system", operated effectively throughout the specified period.
• A service auditor's assurance report conveying reasonable assurance for the matters stated above and that it includes a description of the tests of controls.

Thus, the ISAE 3402 standard will include testing of control objectives for ensuring their operating effectiveness throughout the specified period.