Assurance Reports on Controls at a Service Organization | ISAE 3402

ISAE 3402 is a standard put forth by the International Auditing and Assurance Standards Board (IAASB), a standard-setting board within the International Federation of Accountants (IFAC). ISAE 3402 is an excellent example of the continuing migration in adopting true global accounting standards. ISAE 3402: The International Standard on Assurance Engagements, Assurance Reports on Controls at a Service Organization, is to be the new globally recognized standard for assurance reporting on service organizations. While many past and present standards still exist for reporting on service organizations (SAS 70, CICA 5970, and AAF 01/06), practitioners now have the ability to use a globally accepted framework, thus creating a more unified and transparent reporting tool when reporting on controls at service organizations. As of this writing, it is not yet known what the long-term effect of ISAE 3402 will have in replacing other standards as mentioned.

It should be plausible to assume that the American Institute of Certified Public Accountants SAS 70 standard (which will be superseded by SSAE 16 in 2011 for the effective date), the Canadian Institute of Chartered Accountants CICA 5970 standard, and the Institute of Chartered Accountants in England & Wales (ICAEW) AAF 01/06 (formerly FRAG 21) standard may very well still be used in their own national localities or other regional specific areas.  The intent of ISAE 3402 is not to directly replace these standards, but to provide a globally accepted alternative for primary use, if needed.

User entities, user auditors, service auditors, and service organizations should look upon the new ISAE 3402 standard favorably, as it creates a much needed directive for assurance reporting on todays vast and complex global service organizations. The guidelines and subsequent requirements for reporting on controls as put forth by the ISAE 3402 standard will now gain greater clarity and transparency, allowing user entities and all intended parties to have greater confidence in reports received on service organizations.