ISAE 3402 - Assurance Reports on Controls at a Service Organisation 3402.53: ISAE 3402 paragraph 53: Content of the Service Auditor's Assurance Report

What does 3402.53 require?

The assurance report includes: a title making clear the report comes from an independent service auditor; an addressee; identification of the description and of the service organisation's assertion, of any part of the description the opinion does not cover, of any statement in the description about complementary user entity controls, and of any subservice organisation stating which of the two methods, inclusive or carve-out, is applied; the criteria, and who specified the control objectives; a statement that the report (together with, in type 2 engagements, the description of tests) is meant solely for user entities and their auditors; the responsibilities of the service organisation for the description and assertion, for the services, for the control objectives and for the controls; the service auditor's responsibility for giving an opinion covering the description and the design and, for a type 2 report, on operating effectiveness; a statement that the engagement was carried out under ISAE 3402 and what that standard requires; a summary of the work done and a statement that the evidence gathered is sufficient and appropriate; the inherent limitations of controls and the risk of projecting conclusions into the future; the opinion, in the wording prescribed for the type of engagement (type 1 or type 2); the date of the report; and the auditor's name and where the auditor practises.