New Reporting Requirements for ISAE 3402

The ISAE 3402 standard will require service organizations to "re-think" various aspects of third-party assurance reporting. Specifically, service organizations will need to develop a comprehensive description of its system along with developing a written statement of assertion. In short, these are two of the most fundamentally important technical differences between the ISAE 3402 standard and the previous U.S. Based SAS 70 auditing standard. And yes, there are technical differences that also exist between ISAE 3402 and various country and region specific standards. But, please keep in mind that these differences do not dramatically change the overall intent of third-party assurance reporting on service organizations by practitioners. SAS 70, and possibly other country and region specific standards, will essentially become historical standards that were simply updated and enhanced by the likes of ISAE 3402 and SSAE 16. Service organizations around the globe will still undergo an examination of their control environment from an independent practitioner, resulting in the issuance of a service auditor's report.

Thus, what are the important points to take from the migration of SAS 70 and other country and region specific standards to that of ISAE 3402 (or even SSAE 16)? First and foremost, the description of one's "system" should be looked upon as a very comprehensive description of a number of items-ultimately requiring service organizations to "re-think" and "re-write" their previous SAS 70 description, which only called for a description of one's "controls". Second, the written statement of assertion was NEVER a requirement for SAS 70, but is for ISAE 3402 (and SSAE 16). A competent, well-qualified CPA firm will be able to assist in helping you develop both of these new reporting requirements.