Controls other than Financial Controls for ISAE 3402 Assurance Reporting

Much conversation on the ISAE 3402 standard has focused on the topic of the various controls that form the basis for testing within a Type 1 or Type 2 assurance engagement. Initially, many practitioners felt the ISAE 3402 standard would allow a wide range of controls to be incorporated into the scope of the audit, such as controls over operations, production, and other essential activities within a service organization. 

The stand taken by the IAASB, which is discussed in detail on pages 6 and 7 of Basis for Conclusions: ISAE 3402, Assurance Reports on Controls at a Service Organization, states the following:
The IAASB agreed, therefore, to restrict the use of ISAE 3402 to those engagements where the controls being reported on are likely to be relevant to user entities financial reporting.

Source: Basis for Conclusions: ISAE 3402, Assurance Reports on Controls at a Service Organization, December 2009.

However the IAASB also states in paragraph 25 the following:

determination of whether controls at a service organization related to operations and compliance are likely to be relevant to user entities internal control as it relates to financial reporting is a matter of professional judgment

Source: Basis for Conclusions: ISAE 3402, Assurance Reports on Controls at a Service Organization, December 2009.

Service Organization should thus focus on controls related to financial reporting for user entities, but it seems agreeable that additional controls, which may be outside the scope of financial reporting, but are still relevant to user entities, would be allowable within the scope of an ISAE 3402 engagement undertaken by a service auditor.

NDB Accountants & Consultants recommends careful consultation on this matter with management of the service organization along with the service auditor conducting the ISAE 3402 engagement and all user entities which may receive the report.