Effective Date for ISAE 3402

ISAE 3402 is effective for service auditor's assurance reports covering periods ending on or after June 15, 2011.

Thus, keep in mind if a service organization is undergoing an assurance engagement in accordance with the ISAE 3402 standard,the final deliverable from a service auditor will likely be a report described as any of the following:

• ISAE 3401 Type 1 Service Auditor's Assurance Report
• Independent Service Auditor's Assurance Report on the Description of Controls and their Design
• Report on the Description and Design of Controls at a Service Organization

Similarly, any service organization undergoing an assurance engagement for testing of their controls, in accordance with the ISAE 3402 standard, will likely result in the final deliverable being called the following:

• ISAE 3402 Type 2 Service Auditor's Assurance Report
• Independent Service Auditor's Assurance Report on the Description of Controls, their Design and Operating Effectiveness
• Report on the Description, Design and Operating Effectiveness of Controls at a Service Organization

Service organizations need to be aware of this date so as to conform to the ISAE 3402 standards as needed, especially if requests from user organizations call for an ISAE 3402 assurance report instead of a SAS 70, CICA 5970, AAF 01/06, or some other recognized standard.