Country & Region Specific Standards vs. ISAE 3402

The ISAE 3402 standard, issued in December of 2009 will become the new global standard on assurance reporting on service organizations. Thus, the chatter of late is what will become of the country & region specific standards, such as the AICPA SAS 70 (which is being superseded by SSAE 16), Canada's CICA 5970 and the UK's AAF 01/06 along with other reporting standards (Germany and Japan also have standards in place for reporting on service organizations).

It's important to note that the intent of the ISAE 3402 standard was not to eliminate country & region specific standards and replace it with a new global standard on assurance reporting. Rather, the ISAE 3402 provides an acceptable alternative to other standards that are being used by service auditors when engaging with service organizations for reporting on internal controls.

With that said, some standards are now migrating to one that is similar to that of ISAE 3402, such as the AICPA SAS 70, which will be superseded and effectively replaced by SSAE 16. It's too early to tell if other standards will follow a similar path, but having a global standard such as ISAE 3402 provides more transparency and clarity on the overall process of reporting on internal controls at service organizations.

The complex nature of service organizations and their ever-growing requirements from user entities, regulatory agencies, and other notable users of these reports created a need for a more universally accepted standard, for which ISAE 3402 is.

Service organizations can be found throughout all corners of the globe, thus the ISAE 3402 standard will provide an alternative for reporting, if needed. However, it's plausible to assume that many of the country & region specific standards will still be used to large a degree.