International Standard on Assurance Engagements (ISAE) 3402, Assurance Reports on Controls at a Service Organization

What it is

ISAE 3402 is a standard, not a certificate. Its scope paragraph states that it "deals with assurance engagements undertaken by a professional accountant in public practice to provide a report for use by user entities and their auditors on the controls at a service organization that provides a service to user entities that is likely to be relevant to user entities' internal control as it relates to financial reporting." The standard is effective "for service auditors' assurance reports covering periods ending on or after June 15, 2011". What an organisation obtains under it is an assurance report of a defined type, not a certification.

Who owns it

ISAE 3402 is issued by the International Auditing and Assurance Standards Board (IAASB); the IAASB announced the standard on 18 December 2009 as addressing "reports on the description, design, and operating effectiveness of controls relating to the broad range of services that today's service organizations provide."

Who assesses it

The standard defines the assessor itself: "Service auditor – A professional accountant in public practice who, at the request of the service organization, provides an assurance report on controls at a service organization."

Report types

• Type 1 report — Report on the description and design of controls at a service organization (referred to in this ISAE as a "type 1 report") — the description is assessed "as at the specified date". (ISAE 3402, para. 9(j))
• Type 2 report — Report on the description, design and operating effectiveness of controls at a service organization (referred to in this ISAE as a "type 2 report") — assessed "throughout the specified period", and the report "Includes a description of the tests of controls and the results thereof." (ISAE 3402, para. 9(k))

Who asks for it

The standard names its audience in its own scope paragraph — the report is "for use by user entities and their auditors". No legal instrument requiring an ISAE 3402 report was identified in the sources reviewed as of 29 August 2026 — confirm against the relevant sector regulator.