What does 3402.40 require?

If, after discussion, the service organisation does not reaffirm its assertion or confirm the information and access provided, the service auditor disclaims an opinion.

ISAE 3402 - Assurance Reports on Controls at a Service...

Other controls in Internal audit, written representations, other information and subsequent events (30 to 44) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation

3402.30 ISAE 3402 paragraph 30: Obtaining an Understanding of the Internal Audit Function
3402.31 ISAE 3402 paragraph 31: Determining Whether and to What Extent to Use the Work of the Internal Auditors
3402.32 ISAE 3402 paragraph 32: Determining Whether and to What Extent to Use the Work of the Internal Auditors
3402.33 ISAE 3402 paragraph 33: Determining Whether and to What Extent to Use the Work of the Internal Auditors
3402.34 ISAE 3402 paragraph 34: Using the Work of the Internal Audit Function
3402.35 ISAE 3402 paragraph 35: Using the Work of the Internal Audit Function
3402.36 ISAE 3402 paragraph 36: Effect on the Service Auditor's Assurance Report
3402.37 ISAE 3402 paragraph 37: Effect on the Service Auditor's Assurance Report

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ISAE 3402 - Assurance Reports on Controls at a Service Organisation controls