ISAE 3402 - Assurance Reports on Controls at a Service Organisation
ISAE 3402 (IAASB, effective for service auditors' assurance reports covering periods ending on or after 15 June 2011) governs assurance engagements to report on controls at a service organization likely to be relevant to user entities' internal control over financial reporting, complementing ISAE 3000: acceptance and continuance, assessing the suitability of criteria, materiality, obtaining an understanding of the system, evidence on design and operating effectiveness, the work of an internal audit function, written representations, subsequent events, documentation and the Type 1 and Type 2 report contents. The graph models its 47 requirement paragraphs.
ISAE 3402 - Assurance Reports on Controls at a Service Organisation is a compliance framework from International (IAASB); adopted identically in Australia, New Zealand, Singapore, India, Brazil, Thailand, Japan and elsewhere with 5 domains and 47 controls that map to 9 other frameworks. The largest domains are Internal audit, written representations, other information and subsequent events (30 to 44) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation (15 controls), Documentation and the assurance report (45 to 56) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation (12 controls), Evidence on the description, the design and the operating effectiveness of controls (21 to 29) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation (9 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Conduct, ethics and acceptance (paragraphs 10 to 14) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation
| Code | Title |
|---|---|
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.10 | ISAE 3402 paragraph 10: ISAE 3000 |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.11 | ISAE 3402 paragraph 11: Ethical Requirements |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.12 | ISAE 3402 paragraph 12: Management and Those Charged with Governance |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.13 | ISAE 3402 paragraph 13: Acceptance and Continuance |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.14 | ISAE 3402 paragraph 14: Acceptance of a Change in the Terms of the Engagement |
Criteria, materiality and understanding the system (15 to 20) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation
| Code | Title |
|---|---|
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.15 | ISAE 3402 paragraph 15: Assessing the Suitability of the Criteria |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.16 | ISAE 3402 paragraph 16: Assessing the Suitability of the Criteria |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.17 | ISAE 3402 paragraph 17: Assessing the Suitability of the Criteria |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.18 | ISAE 3402 paragraph 18: Assessing the Suitability of the Criteria |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.19 | ISAE 3402 paragraph 19: Materiality |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.20 | ISAE 3402 paragraph 20: Obtaining an Understanding of the Service Organization's System |
Documentation and the assurance report (45 to 56) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation
Evidence on the description, the design and the operating effectiveness of controls (21 to 29) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation
| Code | Title |
|---|---|
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.21 | ISAE 3402 paragraph 21: Obtaining Evidence Regarding the Description |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.22 | ISAE 3402 paragraph 22: Obtaining Evidence Regarding the Description |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.23 | ISAE 3402 paragraph 23: Obtaining Evidence Regarding Design of Controls |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.24 | ISAE 3402 paragraph 24: Obtaining Evidence Regarding Operating Effectiveness of Controls |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.25 | ISAE 3402 paragraph 25: Obtaining Evidence Regarding Operating Effectiveness of Controls |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.26 | ISAE 3402 paragraph 26: Obtaining Evidence Regarding Operating Effectiveness of Controls |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.27 | ISAE 3402 paragraph 27: Sampling |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.28 | ISAE 3402 paragraph 28: Nature and Cause of Deviations |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.29 | ISAE 3402 paragraph 29: Nature and Cause of Deviations |
Internal audit, written representations, other information and subsequent events (30 to 44) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation
| Code | Title |
|---|---|
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.30 | ISAE 3402 paragraph 30: Obtaining an Understanding of the Internal Audit Function |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.31 | ISAE 3402 paragraph 31: Determining Whether and to What Extent to Use the Work of the Internal Auditors |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.32 | ISAE 3402 paragraph 32: Determining Whether and to What Extent to Use the Work of the Internal Auditors |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.33 | ISAE 3402 paragraph 33: Determining Whether and to What Extent to Use the Work of the Internal Auditors |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.34 | ISAE 3402 paragraph 34: Using the Work of the Internal Audit Function |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.35 | ISAE 3402 paragraph 35: Using the Work of the Internal Audit Function |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.36 | ISAE 3402 paragraph 36: Effect on the Service Auditor's Assurance Report |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.37 | ISAE 3402 paragraph 37: Effect on the Service Auditor's Assurance Report |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.38 | ISAE 3402 paragraph 38: Written Representations |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.39 | ISAE 3402 paragraph 39: Written Representations |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.40 | ISAE 3402 paragraph 40: Written Representations |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.41 | ISAE 3402 paragraph 41: Other Information |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.42 | ISAE 3402 paragraph 42: Other Information |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.43 | ISAE 3402 paragraph 43: Subsequent Events |
| isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.44 | ISAE 3402 paragraph 44: Subsequent Events |
Your Compliance Coverage
If you comply with ISAE 3402 - Assurance Reports on Controls at a Service Organisation, you already cover:
ISO 22301:2019
2%
2 controls mapped
Compare →ISO 37301:2021
1%
1 controls mapped
Compare →ISO 55001:2014
1%
1 controls mapped
Compare →+ 6 more: ISO 37001:2016 (1%), ISO 50001:2018 - Energy Management Systems (1%)
See all 9 mapped frameworks ↓Maps to 9 other frameworks
Coverage is not the same as your position
This page shows what ISAE 3402 - Assurance Reports on Controls at a Service Organisation overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is ISAE 3402 - Assurance Reports on Controls at a Service Organisation and who does it apply to?
ISAE 3402 - Assurance Reports on Controls at a Service Organisation is a compliance framework from International (IAASB); adopted identically in Australia, New Zealand, Singapore, India, Brazil, Thailand, Japan and elsewhere with 5 domains and 47 controls. ISAE 3402 (IAASB, effective for service auditors' assurance reports covering periods ending on or after 15 June 2011) governs assurance engagements to report on controls at a service organization likely to be relevant to user entities' internal control over financial reporting, complementing ISAE 3000: acceptance and continuance, assessing the suitability of criteria, materiality, obtaining an understanding of the system, evidence on design and operating effectiveness, the work of an internal audit function, written representations, subsequent events, documentation and the Type 1 and Type 2 report contents. The graph models its 47 requirement paragraphs. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ISAE 3402 - Assurance Reports on Controls at a Service Organisation actually require?
ISAE 3402 - Assurance Reports on Controls at a Service Organisation has 47 controls organised across 5 domains. The largest domains are Internal audit, written representations, other information and subsequent events (30 to 44) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation (15 controls), Documentation and the assurance report (45 to 56) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation (12 controls), Evidence on the description, the design and the operating effectiveness of controls (21 to 29) – ISAE 3402 - Assurance Reports on Controls at a Service Organisation (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ISAE 3402 - Assurance Reports on Controls at a Service Organisation do I already cover?
ISAE 3402 - Assurance Reports on Controls at a Service Organisation maps to 9 other compliance frameworks. The top mapping partners are ISO 22301:2019 (2% coverage), ISO 37301:2021 (1% coverage), ISO 55001:2014 (1% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement ISAE 3402 - Assurance Reports on Controls at a Service Organisation?
Start your ISAE 3402 - Assurance Reports on Controls at a Service Organisation compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISAE 3402 - Assurance Reports on Controls at a Service Organisation requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 47 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required