ISAE 3402 - Assurance Reports on Controls at a Service Organisation 3402.54: ISAE 3402 paragraph 54: Content of the Service Auditor's Assurance Report

What does 3402.54 require?

In a type 2 report, a separate section placed after the opinion, or attached to the report, sets out which tests of controls were run and their results. It identifies the controls tested, says whether every item in the population or only a selection was tested, and explains the nature of the tests in enough detail for user auditors to work out how the results bear on their own risk assessments. Where deviations were found, the report gives how much testing was done to find them, sample size included, and how many there were and of what kind, and this applies even where, in the auditor's view, the linked control objective was achieved.