ISAE 3402

ISAE 3402
Name	ISAE 3402
Issued by	International Auditing and Assurance Standards Board
First issued	2011
Latest version	2011
Related	International Standard on Assurance Engagements, Statement on Standards for Attestation Engagements, International Financial Reporting Standards

ISAE 3402 ISAE 3402 is an international assurance standard for reporting on controls at a service organization, developed by the International Auditing and Assurance Standards Board and widely used by auditors and service providers. It provides a framework for assurance engagements that focus on internal control over financial reporting and operational processes performed by third parties such as data centers, payroll processors, and managed service providers. The standard is referenced in practice by firms and regulators across jurisdictions including Financial Conduct Authority, Securities and Exchange Commission, and national audit bodies.

Overview

ISAE 3402 sets requirements and guidance for auditors conducting assurance engagements on controls at service organizations, aligning with professional frameworks established by bodies such as the International Federation of Accountants, Institute of Chartered Accountants in England and Wales, and large global accounting networks like Deloitte, PricewaterhouseCoopers, Ernst & Young, and KPMG. It complements reporting frameworks used by multinational corporations including Apple Inc., Amazon (company), Google LLC, and Microsoft when they rely on third-party service providers for critical processes. Standardization efforts link to supranational initiatives from organizations such as the International Organization for Standardization and national regulators like the UK Financial Reporting Council.

Scope and Applicability

ISAE 3402 applies to assurance engagements over controls at service organizations that are relevant to user entities’ financial reporting and related regulatory obligations enforced by agencies including the European Securities and Markets Authority, Office of the Comptroller of the Currency, and Monetary Authority of Singapore. Typical service organizations include providers in sectors represented by NASDAQ, New York Stock Exchange, London Stock Exchange Group, HSBC, JPMorgan Chase, and outsourced vendors servicing firms such as Unilever and Procter & Gamble. The standard is used worldwide across jurisdictions including United States, United Kingdom, Canada, Australia, and Singapore where firms may also consider regional standards like the Sarbanes–Oxley Act compliance and reporting frameworks from bodies like Public Company Accounting Oversight Board.

Types of Reports and Report Contents

ISAE 3402 permits issuance of reports that are designated as Type I and Type II, with content comparable to assurance outputs familiar to users of reports from Ernst & Young, PwC, and KPMG. A Type I report addresses the suitability of design of controls at a specific date and often references organizational elements such as Amazon Web Services, IBM, Oracle Corporation, and Salesforce implementations affecting user systems. A Type II report extends to operating effectiveness over a period and may cite testing results relevant to clients like Citibank, Barclays, Deutsche Bank, and Goldman Sachs. Reports typically include the service auditor’s opinion, management’s description of the system, control objectives, control activities, and complementary user entity controls.

Control Objectives and Controls

Control objectives under ISAE 3402 are defined by management of the service organization and often reflect risks and processes found in industries served by Mastercard, Visa Inc., PayPal Holdings, and Square, Inc.. Controls can encompass logical access, change management, incident management, backup and recovery, and segregation of duties as implemented by providers such as Rackspace Technology, Equinix, Cognizant, and Accenture. User entities like Goldman Sachs, Morgan Stanley, and UBS assess complementary user entity controls when relying on these service organization controls to support financial reporting and compliance with regulations from Basel Committee on Banking Supervision.

Examination Process and Assurance Procedures

The examination under ISAE 3402 is conducted by a qualified practitioner following assurance methodologies used by firms like Grant Thornton, BDO International, and RSM International. Procedures include risk assessment, walkthroughs, tests of design and operating effectiveness, sampling, and evaluation of evidence produced by systems from vendors such as VMware, Cisco Systems, and Dell Technologies. The workpapers and conclusions are intended to enable user auditors at firms including KPMG, PwC, and Deloitte to assess reliance on service organization controls during their own statutory audits, often in contexts governed by authorities such as the International Accounting Standards Board.

Differences from Related Standards (e.g., SSAE, ISAE 3000)

ISAE 3402 is distinct from other assurance frameworks including the Statement on Standards for Attestation Engagements series issued by the American Institute of Certified Public Accountants and the broader ISAE 3000 used for non-financial assurance engagements. While ISAE 3402 focuses specifically on controls at service organizations relevant to financial reporting used by companies like Ford Motor Company, General Motors, and Toyota Motor Corporation, ISAE 3000 applies to environmental, sustainability, and other subject matters often addressed by entities such as World Bank, United Nations, and multinational NGOs. The SSAE framework in the United States aligns with regulatory expectations from bodies like the PCAOB and SEC, whereas ISAE 3402 is intended for international consistency.

Implementation, Compliance, and Criticisms

Implementation of ISAE 3402 involves coordination among service organization management, auditors from networks such as Deloitte, Ernst & Young, PricewaterhouseCoopers, and KPMG, and user entities like Siemens, General Electric, and Siemens AG. Compliance efforts intersect with information security certifications from ISO/IEC 27001, privacy regimes such as those from the European Commission and Data Protection Commission (Ireland), and sector rules enforced by Federal Reserve System or Australian Prudential Regulation Authority. Criticisms include concerns about report variability, dependence on management’s description, and the potential for overreliance by user entities—issues debated by professional bodies including the Institute of Internal Auditors, Chartered Institute of Internal Auditors, and academic researchers at institutions like London School of Economics, Harvard University, and Stanford University.

Category:Accounting standards