Internationally Recognized Standard for Assurance Reporting | ISAE 3402

ISAE 3402 is officially the International Standard on Assurance Engagements (ISAE) 3402, Assurance Reports on Controls at a Service Organization. Put forth initially as an exposure draft in December of 2007, comments were subsequently received on the standard, resulting in the pronouncement of ISAE 3402 in December of 2009.  The ISAE 3402 standard was developed by the International Auditing and Assurance Standards Board (IAASB), one of the more notable boards and committees within the International Federation of Accountants, commonly known as IFAC.  Though there have been, and more than likely will continue to be, a number of nationally recognized accounting standards for reporting on controls at a service organization, the clear goal of ISAE 3402 was to bring about a true global standard for service organization reporting purposes.

The most notable national standard has been that of Statement on Auditing Standards No. 70, commonly known as SAS 70 (will be superseded by SSAE 16), which evolved from the American Institute of Certified Public Accountants (AICPA) in the United States. Put forth in 1992, it eventually gained widespread use as a result of the passage of the 2002 Sarbanes-Oxley Act.  Similarly, other national accounting standards for reporting on service organizations have also gained widespread use and notoriety, such as the Canadian Institute of Chartered Accountants (CICA) 5970, and the Institute of Chartered Accountants in England & Wales (ICAEW) AAF 01/06 (formerly FRAG 21).

Currently, the trend of late for reporting on service organizations has been a mixture of the above three mentioned national standards, along with other lesser known standards. For example, a large number of Canadian service organizations have undertaken compliance with either the CICA 5970 standard along with the American SAS 70 standard.  Likewise, many UK service organizations have also been subject to the AAF 01/06 standard, along with the well-known SAS 70 standard. Other service organization around the globe, ranging from the Far East to Southern Africa, have also undergone various service auditor engagements, with the most notable, once again, being the American Statement on Auditing Standards No.70.

ISAE 3402 will ultimately result in greater clarity and transparency for reporting on controls at service organizations. Its seems plausible at this point to assume that nationally recognized standards, such as the CICA 5970 and the UK AAF 01/06, will continue to be used, rather than being replaced by ISAE 3402. Look upon the ISAE 3402 as a viable option for service organizations that want to utilize a true, global standard.

Of note is the AICPA SAS 70 standard, will be superseded by Statement on Standards for Attestation Engagements (SSAE) 16. SSAE 16 becomes effective for service auditor's reports for periods ending on or after June 15, 2011. Adoption of the SSAE 16 standard for a period earlier than that of June 15, 2011 is allowed.