ISAE 3402 - Assurance Reports on Controls at a Service Organisation

International (IAASB)

v2011

20 domains

34 controls

International Standard on Assurance Engagements (ISAE) 3402, issued by the International Auditing and Assurance Standards Board (IAASB), provides a framework for practitioners to issue assurance reports on controls at a service organisation. Type 1 reports describe controls and their design suitability at a point in time. Type 2 reports also include operating effectiveness testing over a period. Used globally (outside the US where SSAE 18 applies) for service organisation assurance, particularly in financial services, IT outsourcing, and cloud computing.

Unverified

ISAE 3402 - Assurance Reports on Controls at a Service Organisation is a compliance framework from International (IAASB) with 20 domains and 34 controls that map to 15 other frameworks. The largest domains are Engagement (3 controls), Engagement Requirements (3 controls), System Description (3 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (20)

Assertion

1 controls

Controls in the Assertion domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.2	Management Written Assertion	Service organisation management provides a written assertion describing the system and the suitability and operating eff...

Communication

2 controls

Controls in the Communication domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 2 controls
Code	Title	Description
ISAE3402.18	Communication with Service Organisation	Communicate identified deficiencies, fraud or noncompliance to service organisation management on a timely basis.
ISAE3402.20	Bridge Letters	Service organisation may issue bridge letters to user entities covering the gap between report period end and user entit...

Description

2 controls

Controls in the Description domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 2 controls
Code	Title	Description
ISAE3402.10	Complementary User Entity Controls (CUECs)	Identify CUECs that the user entity must implement for the service organisation's controls to achieve their objectives.
ISAE3402.3	System Description	Prepare a fair description of the service organisation's system covering services, processes, controls, IT and complemen...

Design

1 controls

Controls in the Design domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.5	Control Design Assessment (Type 1 and 2)	Service auditor evaluates whether controls are suitably designed to achieve the stated control objectives.

Distribution

1 controls

Controls in the Distribution domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.21	Restricted Use	Restrict distribution of the service auditor report to management, user entities and their auditors.

Documentation

1 controls

Controls in the Documentation domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.16	Documentation	Prepare assembly file of audit documentation supporting the report within 60 days of the report date.

Engagement

3 controls

Controls in the Engagement domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 3 controls
Code	Title	Description
ISAE3402.1	Engagement Acceptance	Service auditor accepts the engagement only if preconditions are met, including suitable criteria and management respons...
ISAE3402.19	Period Covered for Type 2	Type 2 reports normally cover a minimum period of six months; shorter periods require disclosure.
ISAE3402.7	Type 1 vs Type 2 Selection	Select report type based on user needs: Type 1 covers design at a point in time, Type 2 covers design and operating effe...

Engagement Requirements

3 controls

Controls in the Engagement Requirements domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 3 controls
Code	Title	Description
ISAE3402-1	Engagement Acceptance	Service auditor shall accept engagement only when competent to evaluate service organization's controls.
ISAE3402-2	Materiality and Risk	Consider materiality when planning and performing the engagement, applying professional judgment.
ISAE3402-3	Evidence and Documentation	Obtain sufficient appropriate evidence to support the assurance opinion on controls.

Events

1 controls

Controls in the Events domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.13	Subsequent Events	Inquire about and consider events occurring between the period end and the date of the service auditor report.

Management Assertion

2 controls

Controls in the Management Assertion domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 2 controls
Code	Title	Description
ISAE3402-7	Management Statement	Management provides written assertion about fair presentation and suitability of control design.
ISAE3402-8	Control Objectives	Management identifies control objectives and states controls suitably designed to achieve them.

Objectives

1 controls

Controls in the Objectives domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.4	Control Objectives	Define control objectives that address risks threatening achievement of the financial reporting assertions of user entit...

QC

1 controls

Controls in the QC domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.17	Quality Control	Apply firm quality management system including engagement quality reviews for high risk service auditor engagements.

Reliance

1 controls

Controls in the Reliance domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.12	Use of Internal Audit Work	Where internal audit work is used, assess competence, objectivity and quality before placing reliance.

Report

2 controls

Controls in the Report domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 2 controls
Code	Title	Description
ISAE3402.14	Service Auditor Report Content	Issue report including scope, criteria, opinion, basis for opinion, description of tests and results (Type 2) and other...
ISAE3402.15	Modified Opinions	Issue qualified, adverse or disclaimer opinions where description, design or operating effectiveness is materially defic...

Risk

1 controls

Controls in the Risk domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.11	Risk Assessment by Service Auditor	Service auditor performs risk assessment to identify risks of material misstatement in the description and controls.

Subservice

2 controls

Controls in the Subservice domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 2 controls
Code	Title	Description
ISAE3402.8	Carve Out Method	Under carve out, exclude subservice organisation controls from scope and clearly state user entities must consider them.
ISAE3402.9	Inclusive Method	Under inclusive method, include subservice organisation controls in the system description and testing scope.

System Description

3 controls

Controls in the System Description domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 3 controls
Code	Title	Description
ISAE3402-4	Description of System	Service organization provides description including nature of services, control objectives, and related controls.
ISAE3402-5	Fair Presentation	System description shall be fairly presented covering services, processes, roles and responsibilities.
ISAE3402-6	Complementary User Entity Controls	Identify controls assumed to be implemented by user entities in the design of the system.

Testing

1 controls

Controls in the Testing domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 1 controls
Code	Title	Description
ISAE3402.6	Operating Effectiveness Testing (Type 2)	For Type 2 reports, test operating effectiveness across a period (usually 6 to 12 months) using sampling and reperforman...

Type I Report

2 controls

Controls in the Type I Report domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 2 controls
Code	Title	Description
ISAE3402-T1-1	Design of Controls at Point in Time	Type I covers description and suitability of control design at a specific point in time.
ISAE3402-T1-2	Service Auditor Opinion (Type I)	Opinion on whether description is fairly presented and controls are suitably designed.

Type II Report

3 controls

Controls in the Type II Report domain of ISAE 3402 - Assurance Reports on Controls at a Service Organisation — 3 controls
Code	Title	Description
ISAE3402-T2-1	Operating Effectiveness (Min 6 Months)	Type II includes testing of operating effectiveness over minimum six-month period.
ISAE3402-T2-2	Tests and Results	Service auditor describes tests performed and results for each control.
ISAE3402-T2-3	Service Auditor Opinion (Type II)	Opinion on fair presentation, design suitability, and operating effectiveness during reporting period.

Your Compliance Coverage

If you comply with ISAE 3402 - Assurance Reports on Controls at a Service Organisation, you already cover:

ISO 22301:2019

2 controls mapped

Compare →

ISO 13485:2016

2 controls mapped

Compare →

ISO 31000:2018

2 controls mapped

Compare →

+ 12 more: ISO 45001:2018 (3%), ISO 22000:2018 (3%)

See all 15 mapped frameworks ↓

Maps to 15 other frameworks

34 total controls

ISO 22301:2019

2 source controls mapped|3 target controls covered

ISO 13485:2016

2 source controls mapped|2 target controls covered

ISO 31000:2018

2 source controls mapped|2 target controls covered

ISO 45001:2018