ISAE 3402 is the international standard for a report in which an accountant gives assurance on the controls at a service organisation, such as a payroll processor, data centre or fund administrator, that matter to its customers' financial reporting. SAE 3402 is the ICAI counterpart. The customer and its auditor use the report to understand and rely on controls they cannot test themselves.
Last reviewed: 17 October 2026. Facts checked. We opened the IFAC-hosted IAASB Handbook text of ISAE 3402 and the IAASB staff overview page. For SAE 3402 we saw only a search-result summary describing it as the ICAI counterpart of ISAE 3402. We could not open the ICAI document itself, so we do not quote ICAI wording or paragraph numbers. We did not check whether any later IAASB revision affects the standard.
The problem it solves
A company outsources something that touches its accounts. Payroll, hosted accounting software, custodial services, claims processing. The company's auditor now has a gap. The controls that protect the numbers sit in someone else's premises.
The auditor cannot walk in and test every service provider's controls for every customer. So the provider hires a "service auditor" once, and the report is shared with all its customers. ISAE 3402 says the standard is meant to give assurance to user entities and their auditors about controls relevant to the users' internal control over financial reporting. It is meant to work alongside ISA 402, which covers audits of entities that use a service organisation, and reports under ISAE 3402 can provide appropriate evidence under that standard.
The players
| Term | Meaning |
|---|---|
| Service organisation | The provider whose controls are described |
| User entity | A customer using the service |
| Service auditor | A professional accountant in public practice who reports on the controls |
| User auditor | The auditor of the user entity |
| Subservice organisation | A provider used by the service organisation |
What the report contains
Management of the service organisation gives a written assertion. In essence, it says the description of its system is fairly presented, the controls were suitably designed and, in a Type 2 report, that they operated effectively. The service auditor's report then gives reasonable assurance on those matters. That is worth noting. It is not a limited assurance report. Compare our guide to reasonable vs limited assurance.
A report has three parts:
- The service organisation's description of its system.
- Management's written assertion.
- The service auditor's assurance report.
Type 1 vs Type 2
| Type 1 | Type 2 | |
|---|---|---|
| Looks at | Description and design of controls | Description, design and operating effectiveness |
| Time frame | As at a specified date | Throughout a specified period |
| Tests of controls | Not part of the report | Described in the report with the results |
| Use for a user auditor | Limited: shows the design on one day | Stronger: shows controls over a period |
A Type 2 report must include a description of the tests performed and the results. The question for a user auditor is usually: "Did the controls work throughout my client's year?" Only Type 2 speaks to that. How long the period needs to be is a point for the user auditor's judgment and the engagement terms. We have not stated a minimum, because we did not confirm one in the standard text.
Subservice organisations: carve-out
If the service organisation relies on another provider, the report can treat that provider by the carve-out method. Under it, the description includes the nature of the subservice organisation's services, but that provider's own controls are excluded from the description and from the scope of the engagement. The service organisation's monitoring of that provider stays in scope. If you are a user, find out what is carved out and see whether you need a report from the subservice organisation too.
Complementary user entity controls
The provider assumes certain controls will sit with you. For example, "the customer reviews the monthly reports and approves changes." The report lists these as complementary user entity controls. If you are the user and you do not operate them, the provider's controls may not be enough. This is where reliance on a report usually breaks down.
A checklist for CAs relying on a report
Use this when your client outsources and you plan to rely on a report.
- Right standard and type. Is it Type 2, or only Type 1?
- Right period. Does it cover your client's financial year, or is there a gap? Plan how to cover the gap.
- Right services and locations. Is the outsourced process in the description?
- Opinion modified? Read the service auditor's opinion, including any qualification.
- Exceptions in the test results. Read the section on tests and results. Exceptions matter.
- Complementary user entity controls. Does your client actually operate them?
- Subservice organisations. Carved out? If so, what else do you need?
- Service auditor competence and independence. Is the service auditor a professional accountant in public practice, with relevant experience?
- Document the reliance. Record what you relied on and why.
ISAE 3402 and other reports
ISAE 3402 is aimed at controls relevant to financial reporting. Reports on security, availability and similar criteria for other purposes are different, and sit under other frameworks. Our post on SOC 1, SOC 2 and SOC 3 explains which to ask a vendor for. An ISAE 3402 report also differs from an agreed-upon procedures report, which gives no assurance. See agreed-upon procedures under SRS 4400.
If you are the service organisation
Preparing for the first report is mostly about readiness, not the audit itself. Define the services and the system, list control objectives, assign control owners, keep evidence, and decide whether a Type 1 or Type 2 report is the right first step. Management must be willing to sign the assertion. If management cannot support the assertion with suitable criteria, the engagement should not go ahead.
Frequently Asked Questions
What is ISAE 3402 in simple words?
It is a standard for a report in which an accountant gives assurance on the controls at a service provider that matter to its customers' financial reporting.
What is SAE 3402?
It is the ICAI counterpart of ISAE 3402, as described in the summary we saw. We could not open the ICAI document to confirm wording, so check it before citing.
What is the difference between Type 1 and Type 2?
Type 1 covers the description and design of controls at a date. Type 2 also covers whether they operated effectively over a period, and includes the tests and results.
Who gets the report?
User entities and their auditors. Reports are normally intended for those users, and not for general circulation.
Does the report give limited or reasonable assurance?
The standard describes the service auditor's report as conveying reasonable assurance on the matters covered.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error