Roadmap to Compliance for Service Organizations | ISAE 3402

The following material outlines relevant areas that all service organizations need to be aware of regarding the new ISAE 3402 standard. Listed below are key considerations and topics to address regarding the new global assurance reporting standard-ISAE 3402.

• Gain an Understanding of the new ISAE 3402 Standard

Meet with your service auditor to discuss the technical requirements of the new ISAE 3402 standard, including, but not limited to, the following items: (1) Producing a documented description of the service organizations “system”. (2). Understanding the role of your internal audit department and how it may potentially compliment the audit process. (3). Developing a "written statement of assertion" to be included in the final assurance report as mandated. (4). Providing the service auditor with other, as needed written representations.

• Develop a Description of your Service Organization's "system"

The service organization's description of its "system" is a vital component of the final assurance report developed by the service auditor. As such, it's important to readily understand what the minimum required contents of the description of the "system" are for purposes of the ISAE 3402 standard.

• Understand the role of the Internal Audit Function

The role of a service organization's internal audit department can potentially have a large and significant effect on the overall engagement. Thus, management of the service organization and the service auditor performing the ISAE 3402 engagement will need to identify the following:

• The role of the service organization's internal audit function and its relevancy to the scope of the audit, if any.
• The technical competency, objectivity, and usefulness of the data and supporting material developed by the internal audit department.

• Develop a written statement of Assertion

The ISAE 3402 standard requires management of the service organization to prepare a written statement of assertion regarding a number of items, such as the service organization's "system", the control objectives and related controls that were designed (in the case of a Type I) and their operating effectiveness (in the case of a Type II).

In summary, the ISAE 3402 standard will require service organizations to be educated, prepared and ready to meet the demands of the new global assurance reporting standard.

Additionally, the ISAE 3402 Resource Guide, developed by NDB Accountants & Consultants, will continue to update information in a timely and relevant matter concerning the new global assurance standard for reporting on service organizations.