Service Organizations and ISAE 3402

There are many types of service organizations in today's world of regulatory compliance that are being required to undertake an examination of their internal controls, ultimately resulting in the issuance of a Service Auditor's Reports and/or Assurance Reports. Whether it be current country specific standards, such as SAS 70 (which is migrating to SSAE 16), CICA 5970, the recently pronounced ISAE 3402 or other types of recognized standards, service organizations will continue to have their internal controls frameworks examined. As such, it is worth mentioning some of the most common examples of service organization's in today's regulatory compliance arena.

• Software as a Service (SaaS)
• Software Development Organizations | Software Vendors
• Data Centers
• Managed Services Entities
• Internet Service Providers
• Registered Investment Advisers (RIA)
• Third Party Administrators (TPA) | Health and Benefits Administration
• Fulfillment Organizations (Print and Mail)
• Rebate Fulfillment Organizations (Online and Mail)
• Medical Claims Processors
• Clearinghouses
• Payroll Services
• Mortgage Services
• Call Centers
• Instant Messaging | Chat Software Vendors
• e-Commerce Platforms
• Data Destruction Companies
• Actuarial
• Service Bureaus

ISAE 3402 will almost certainly play a large and ever-expanding role in providing assurance reporting services for these types of service organizations. Accounting standards are migrating towards a global framework, thus, please be advised of the importance in communicating with your service auditor and other as needed entities regarding changes for Service Auditor Reports and/or Assurance Reports, such as that of ISAE 3402.