ISAE 3402, put forth by the International Auditing and Assurance Standards Board (IAASB) of the International Federation of Accountants (IFAC), will play a large and ever-expanding role for reporting on controls at service organizations. The ISAE 3402 standard requires two (2) important components that will fundamentally change reporting for service organizations: 1. Management must provide a written assertion and 2. management must provide a description of the service organization’s “system”.
There are also a number of other roles, responsibilities, and requirements which management must undertake, but what’s important to note at this point is why the new auditing standard came to be, effectively creating a need for the U.S. standard (SAS 70) to be replaced, which is being done with SSAE 16.
ISAE 3402 represents a migration towards global accounting principles and standards; one that creates transparency and much more clarity when reporting on controls at service organizations. SAS 70, the standard used globally by many practitioners, had been showing its limitations for a number of years, due in large part that it was a U.S. based standard and was not always meeting the ever-growing and complex reporting requirements for service organizations.
ISAE 3402 (and the U.S. Standard of SSAE 16) are soon on their way to becoming the “standard” for reporting on controls at service organizations. Early adoption of the two standards is permitted, but it seems likely most service organizations will wait until 2011. Be prepared and get the facts about the ISAE 3402 standard.