ISAE 3402: Service Organization Assurance Report Guide
ISAE 3402 is the international assurance standard for reporting on controls at service organizations that are relevant to user entities' internal control over financial reporting. It is the global equivalent of the US SSAE 18 standard and provides the framework for what are commonly known as SOC 1 reports outside the United States. ISAE 3402 reports give user organizations and their auditors confidence that a service provider's controls are appropriately designed and operating effectively.
What ISAE 3402 Covers
ISAE 3402 defines requirements for the service auditor to obtain sufficient appropriate evidence to provide a reasonable assurance opinion on the service organization's description of its system and the suitability of control design (Type 1) and operating effectiveness (Type 2). The standard governs the structure and content of the report including the service organization's description, management's assertion, the auditor's report, and the description of tests and results.
Type 1 reports assess control design at a specific point in time. Type 2 reports assess both design and operating effectiveness over a defined period (minimum six months). Type 2 reports are significantly more valuable as they demonstrate that controls actually worked as designed over time.
Who Needs ISAE 3402 Reports
Service organizations whose services affect their clients' financial reporting controls should obtain ISAE 3402 reports. This includes payroll processors, hosting providers managing financial applications, payment processors, fund administrators, claims processors, and any outsourced service that affects the integrity of client financial data. In many jurisdictions, user entity auditors require ISAE 3402 reports to support their own audit opinions.
Engagement Process
The service organization defines control objectives and describes its system. Management prepares an assertion about the fairness of the description and design (and effectiveness for Type 2) of controls. The service auditor plans and executes testing, examines evidence, and issues a report with an opinion. For Type 2 engagements, the auditor tests operating effectiveness through inquiry, observation, inspection, and reperformance over the reporting period.
Cost Considerations
ISAE 3402 reports typically cost $30,000 to $150,000 depending on scope, number of controls, and report type. Type 2 reports cost approximately 40-60% more than Type 1 due to the extended testing period. Organizations should also budget for internal readiness activities including control documentation, evidence preparation, and remediation of any issues identified during testing.