Assurance Reports on a Service Organization's Controls - Completed
Denise Esdon, Chair (and Chair of the ISA 402 Task Force)
Romek Lubaczewski, External member (PwC, Poland)
Calum Thomson, External member (Deloitte, UK)
Karsten Tom Dieck, External member (KPMG, Germany)
Rick Wood, External member (Grant Thornton, Canada)
George Tucker, IAASB Technical Adviser, was chair of the Task Force till December 2007.
Objective(s) of project
To develop a new International Standard on Assurance Engagements: ISAE 3402, Assurance Reports on a Service Organization's Controls.
Reasons that drove the need to develop ISAE 3402 included the following:
- National standard-setters, who have updated or developed standards on service auditor responsibilities and reporting in recent years, have requested that the IAASB consider development of such a standard.
- Practitioners are dealing with the issues arising from increased use of service organizations.
This project did not deal with the audit of the financial statements of an entity that uses a service organization. This was handled in the project to revise extant ISA 402, Audit Considerations Relating to Entities Using Service Organizations.
Task Force progress / Board discussions to date
The IAASB considered and approved the project proposal at its March 2006 meeting. An issues paper was discussed at the September 2006 IAASB meeting. A further issues paper and a preliminary draft of the Introduction and Requirements sections of the ISAE were considered at theApril 2007 meeting, and a first read draft was considered at the September 2007 meeting.
An Exposure Draft was approved at the December 2007 meeting. The comment period for the Exposure Draft closed on May 31, 2008.
Significant issues raised on exposure, and the implications for this project of the AICPA's Proposed Statement on Standards for Attestation Engagements, Reporting on Controls at a Service Organization considered by the IAASB at its December 2008 meeting and June 2009 meeting.
The IAASB approved ISAE 3402, Assurance Reports on Controls at a Service Organization at its September 2009 meeting . The ISAE is effective for service auditors' assurance reports covering periods ending on or after June 15 2011. A Basis for Conclusions provides background to the project, main comments received on the exposure draft, and the IAASB's conclusions regarding these comments in developing the final standard. A Staff Overview of the final standard is also available.