Key Facts
- Regulator
- International Auditing and Assurance Standards Board (IAASB), under the International Federation of Accountants (IFAC)
- Latest version
- ISAE 3402, Assurance Reports on Controls at a Service Organization, as issued by the IAASB in December 2009
- Effective
- 18 December 2009
- Official text
- www.iaasb.org ↗
What is ISAE 3402?
ISAE 3402 is the international standard for assurance reports on controls at a service organisation. The International Auditing and Assurance Standards Board (IAASB), under IFAC, issued it in December 2009. It applies to outsourced-service providers whose controls matter to their customers' financial reporting, and to the auditors who report on those controls.
The full title is ISAE 3402, Assurance Reports on Controls at a Service Organization, in the version the IAASB released on 18 December 2009. ISAE 3402 was the first new assurance standard, other than the International Standards on Auditing (ISAs), developed under the IAASB's International Framework for Assurance Engagements. ISAE 3402 is effective for service auditors' reports covering periods ending on or after 15 June 2011.
The standard addresses reports on the description, design and operating effectiveness of a service organisation's controls, across a broad range of outsourced services. An ISAE 3402 report, sometimes called an ISAE 3402 audit, is the service auditor's report under this standard.
Why it matters
The customer's auditor asks how the controls at your company work. You have a policy document. They want independent assurance.
ISAE 3402 exists for that moment. The IAASB framed it around service organisation controls that bear on the quality of user entities' financial reports and on what their auditors need under the ISAs. A service auditor's report gives those auditors something to rely on.
A policy describes what you intend. A service auditor's report describes what happened.
Three parties feel the pressure:
- User entities need to know that the controls at the organisations they outsource to support their own financial reporting.
- User auditors need evidence for their own work under the ISAs.
- Service organisations need a recognised form in which to give that assurance.
Who it applies to
ISAE 3402 applies to service organisations: businesses that provide a service whose controls matter to their customers' financial reporting, and the service auditors engaged to report on those controls. The people who read the reports are user entities, the customers, and their auditors. A firm that only buys outsourced services reads a report; it does not commission one.
ISAE 3402 is a professional assurance standard, not legislation. A service organisation obtains a report when its customers and their auditors need that assurance, which is the need the standard was written to serve.
ISO 27001 is the closest framework most readers already know, and it answers a different question. ISO 27001 concerns an information security management system. ISAE 3402 concerns an independent report on a service organisation's controls, including how they operated.
Customers may also ask for SOC 2 or for SOC 1, the AICPA's US report on controls relevant to user entities' financial reporting, issued under SSAE 18 (AT-C 320). Ask which one the customer's auditor accepts before commissioning anything.
The UK position
A UK firm meets ISAE 3402 when its customers or their auditors ask for a report. Two UK regimes sit beside it:
| Regime | What it is |
|---|---|
| ICAEW TECH 01/20 AAF | UK guidance for service auditors reporting on the internal controls of outsourced services |
| ISAE (UK) 3000 | The FRC's UK version of the umbrella assurance standard on which ISAE 3402 builds, issued in July 2020 |
ICAEW notes that demand for AAF reports is particularly high in the asset management sector. If your customers are UK asset managers, ask whether they want a TECH 01/20 AAF report, an ISAE 3402 report or both.
The FRC revised ISAE (UK) 3000 in September 2026, and the revised text takes effect from 15 December 2026 (FRC assurance standards).
Key requirements
ISAE 3402 is an assurance standard: it governs the report a service auditor gives on a service organisation's controls. The report addresses three subjects:
- Description. The description of the controls relating to the services the organisation provides.
- Design. The design of those controls, as distinct from whether they ran.
- Operating effectiveness. How effectively those controls operated over the period the report covers.
The common thread is relevance. The controls in scope are those relating to the services provided, with weight on what bears on user entities' financial reports. The controls list therefore differs from one ISAE 3402 report to the next.
A control described but never tested is a statement of intent.
The parties
The roles are:
- Service organisation: provides the outsourced service and answers for the controls described.
- Service auditor: gives the assurance report on those controls.
- User entity: the customer that uses the service.
- User entity's auditor: relies on the report for work under the ISAs.
Frequently asked questions
An ISAE 3402 report is a service auditor's assurance report on a service organisation's controls, issued under the IAASB's ISAE 3402. ICAEW describes its scope as the controls over the service provided that are relevant to user entities' internal control over financial reporting. So the readers of an ISAE 3402 report are the service organisation's customers and their external auditors.
ISAE 3402 is the IAASB's international standard. SOC 1 is the AICPA's US report, issued under SSAE 18 (AT-C 320); the AICPA also publishes SOC 2 and SOC 3. Both ISAE 3402 and SOC 1 cover service organisation controls relevant to user entities' financial reporting. Because they come from different standard-setters, confirm which one the customer's auditor accepts before commissioning a report.
ISAE 3402 does not lead to a certificate. A service auditor issues an assurance report on the description, design and operating effectiveness of a service organisation's controls, and customers and their auditors rely on that report. The standard governs how that engagement is reported; it is not a certification scheme.
ISAE 3000 (Revised) is the IAASB's general standard for assurance engagements other than audits or reviews of historical financial information. ISAE 3402 is a separate standard for one subject: ICAEW describes it as expanding on how ISAE 3000 (Revised) is applied in a reasonable assurance engagement to report on controls at a service organisation. If a customer asks for an ISAE 3402 report, ISAE 3000 alone does not answer it.
No UK law requires an ISAE 3402 report: a UK service organisation commissions one when its customers or their auditors ask. The UK guidance for the same kind of engagement is ICAEW's TECH 01/20 AAF, effective for reporting periods beginning on or after 1 July 2020. It replaced TECH 01/06 AAF, withdrawn on 30 June 2020, so a request for an AAF 01/06 report is out of date.