Assurance reports on internal controls of service organisations made available to third parties (Technical Release 01/20 AAF)

What it is

AAF 01/20 "has been developed to enable the Service Organisation to engage an independent practitioner (the 'Service Auditor') to provide an assurance opinion over the relevant controls which seek to manage risks on behalf of User Entities." (para. 2) It is a technical release, not a certificate — the output is an assurance opinion.

"AAF 01/20 replaces AAF 01/06 and is effective for periods beginning on or after 1 July 2020. Early adoption of this guidance is encouraged." (para. 12)

Who owns it

AAF 01/20 is issued by the ICAEW Audit and Assurance Faculty.

Who assesses it

The document names the assessor as "an independent practitioner (the 'Service Auditor')" (para. 2); it does not state in the passage reviewed that this role is limited to a specific accountancy qualification.

Who asks for it

Buyer-driven. The document's own account of origin names specific sectors only: "The demand for Service Organisations to report on their internal controls to User Entities originated in the asset management sector" (para. 6) — later extended to pension administration, fund management and IT service organisations per the same paragraph. Not asserted as demand from every possible service-organisation sector.

"The demand for Service Organisations to report on their internal controls to User Entities originated in the asset management sector" (para. 6), per the document's own account of its history.