ISAE 3402

Why does it matter?

ISAE 3402 gives user entities and their auditors an independent report on the controls of an outsourced service, capable of providing appropriate evidence under ISA 402 (paragraph 1). It sets what the service organization must describe and what the service auditor must test, so reports from different providers are read on the same basis.

Key benefits include:

• Type 1 and Type 2 reports

A Type 1 report covers description and design at a specified date. A Type 2 report adds operating effectiveness throughout a period (paragraphs 9(j) and 9(k)).

• A defined system description

The description covers services, procedures, records, how significant events are handled, control objectives, controls and complementary user entity controls (paragraph 16(a)).

• Subservice organizations are visible

The report states whether the inclusive or the carve-out method is used for each subservice organization (paragraphs 9(a), 9(g) and 21(d)).

• Tested, not assumed

In a Type 2 report the auditor tests controls over the period, cannot reduce testing because of earlier periods, and reports deviations (paragraphs 24 and 54).

• Responsibilities are written down

The service organization acknowledges its responsibility for the description, its statement, the control objectives and the controls (paragraph 13(b)).

How does it work?

ISAE 3402 sets requirements on compliance with ISAE 3000 (Revised) (paragraph 10), ethics (11), acceptance and continuance (13 and 14), suitability of criteria (15 to 18), materiality (19), understanding the system (20), evidence on the description (21 and 22), design (23) and operating effectiveness (24 to 29), the work of an internal audit function (30 to 37), written representations (38 to 40), documentation (45 to 52) and the report (53 to 55).

The criteria must cover how the system was designed and implemented, including services, procedures, records, significant events, control objectives, controls and complementary user entity controls (paragraph 16). For design, the auditor identifies the risks that threaten the control objectives and evaluates how the controls link to them (paragraph 23).

In a Type 2 report the auditor combines inquiry with other procedures to learn how a control was applied, how consistently and by whom, and may use sampling (paragraphs 24 to 27).

Key Elements

• Description and statement (paragraphs 9(n), 9(o) and 16)

The service organization's description of its system and its written statement that the description is fairly presented and the controls are suitably designed, and for Type 2 operated effectively.

• Control objectives and controls (paragraphs 9(c) and 9(d))

The aim of a particular aspect of controls, tied to risks, and the controls that achieve it. The service organization states them, or names the party that specified them (paragraph 13(b)).

• Complementary user entity controls (paragraphs 9(b) and 53(c)(iii))

Controls the service organization assumes user entities will implement. The report states that the auditor has not evaluated them.

• Subservice organizations (paragraphs 9(a) and 9(g))

Under the carve-out method their controls are excluded from the scope. Under the inclusive method they are included.

• Tests of controls (paragraphs 24 to 27 and 54)

In a Type 2 report, the controls tested, the nature of the tests, the items selected and any deviations are described.

• The service auditor's report (paragraphs 53 to 55)

An opinion in positive form, a statement that use is limited to user entities and their auditors, and a modified opinion with reasons where findings require it.

What does it cover?

ISAE 3402 applies when the service organization provides a service likely to be relevant to user entities' internal control over financial reporting and is responsible for, or able to make a statement about, the suitable design of controls (paragraphs 1 and 3). It does not deal with reports only on whether controls operated as described, or with controls unrelated to financial reporting, such as those affecting production or quality control. ISAE 3000 (Revised) covers those engagements (paragraph 3). It deals only with reasonable assurance attestation engagements (paragraph 2).

What are its objectives?

The service auditor's objectives are to obtain reasonable assurance about three matters, based on suitable criteria, and to report on them (paragraph 8):

The service organization's description fairly presents its system as designed and implemented throughout the specified period, or as at a specified date in a Type 1 report.

The controls related to the stated control objectives were suitably designed throughout the period, or as at the date.

Where included in the scope, the controls operated effectively throughout the specified period.

Framework in Context

ISAE 3402 supplements ISAE 3000 (Revised) and expands how it applies to controls at a service organization (paragraph 5). It complements ISA 402, which addresses an auditor of a user entity that uses a service organization (paragraph 1). In the United States, SOC 1 reports under AT-C section 320 of the AICPA's SSAE No. 18 address controls relevant to user entities' internal control over financial reporting. The standard was issued in December 2009, and the current IAASB Handbook text refers to ISQM 1 for firm quality management (paragraph 6).

Common Framework Mappings

ISAE 3402 is often mapped to other security, risk, and IT governance frameworks to simplify audits, demonstrate broad controls coverage, and meet diverse regulatory or customer requirements.

Mapped frameworks include:

COBIT

ISAE 3000

ISO/IEC 27001

NIST Cybersecurity Framework

NIST SP 800-53

PCI DSS

SOC 1 (SSAE 18)

SOC 2