An ISAE 3402 report is an independent assurance report on the controls that a service organisation operates over a service it provides to its customers, such as payroll processing, fund administration or a hosted finance system. A type 1 report covers whether the controls are fairly described and suitably designed at a single date; a type 2 report also tests whether they operated effectively over a period. Customers and their auditors ask for them because they cannot easily inspect those controls themselves.

What is an ISAE 3402 report?

ISAE 3402, Assurance Reports on Controls at a Service Organization, is an international standard issued by the IAASB. ICAEW describes it as the standard for practitioners giving an assurance report on internal controls at service organisations, covering the controls over the service that are relevant to the customers’ own internal control over financial reporting. It expands on how ISAE 3000 (Revised) applies in a reasonable assurance engagement on controls at a service organisation.

ICAEW explains that the arrangement involves three parties:

  • the service organisation, which issues the report and commissions the work;
  • its customers (user organisations), which want to rely on the report; and
  • the independent reporting accountants, often called service auditors.

The report itself has two parts. Management of the service organisation prepares a description of its system, its control objectives and the related controls. The service auditor then gives an opinion on that description and on the controls. ISA (UK) 402, the auditing standard that covers audits of entities using service organisations, sets out these components in paragraph 8.

What is the difference between a type 1 and a type 2 report?

ISA (UK) 402 paragraph 8 defines both report types.

Feature Type 1 report Type 2 report
Formal name Report on the description and design of controls Report on the description, design and operating effectiveness of controls
Timing As at a specified date Throughout a specified period
Opinion covers The description and the suitability of the design of controls to achieve the control objectives The description, the suitability of design and the operating effectiveness of the controls
Tests of controls None reported The service auditor’s tests and their results are described
Main use to a customer’s auditor Understanding the controls Evidence that the controls worked during the period

Because a type 1 report needs no history of testing, a service organisation can produce one sooner. A customer whose auditor wants evidence that controls worked across the customer’s financial year will need a type 2 report, or other testing, as explained below.

Why do customers and their auditors ask for one?

When a company outsources part of its finance processing, its external auditor still has to understand the controls over that processing. Paragraph 12 of ISA (UK) 402 says that, where the user auditor cannot get enough understanding from the company itself, it can obtain a type 1 or type 2 report, contact the service organisation through the company, visit the service organisation, or use another auditor. If the auditor needs evidence that controls operated effectively, paragraph 16 lists a type 2 report, its own tests at the service organisation, or tests by another auditor.

A report therefore saves the service organisation from repeated visits by many different auditors. ICAEW makes the same point in its introduction to TECH 01/20 AAF: because a service organisation usually works for more than one entity, it can commission one independent assurance opinion and share it, saving numerous sets of external auditors testing the same controls. ICAEW notes that demand is particularly strong in the asset management sector.

For the practical side of handing work to third parties, see outsourcing and offshoring work.

How does ISAE 3402 relate to AAF 01/20 and SOC reports?

In the UK, ICAEW’s technical release TECH 01/20 AAF, Assurance on internal controls of service organisations, gives good practice guidance for these engagements. It is effective for reporting periods beginning on or after 1 July 2020, and its predecessor, TECH 01/06 AAF, was withdrawn on 30 June 2020. ICAEW says its scope covers internal controls over the service the service organisation provides and is not restricted to controls related to financial reporting, and that it contains reporting and assessment criteria for a range of financial service organisations.

The US equivalent is the AICPA standard SSAE 18. ICAEW explains that the AICPA’s SOC framework complements it: SOC 1 reports address internal control over financial reporting, while SOC 2 covers IT related controls such as those for cloud computing, managed services and data centres. A SOC 2 report is therefore not a substitute for an ISAE 3402 report when the customer’s auditor needs evidence about financial processing.

For independence, ICAEW’s helpsheet places assurance reports under AAF 01/20, and other engagements based on ISAE 3000 such as those on controls at a service organisation, under Part 4B of the ICAEW Code of Ethics, assuming the work is not done by the entity’s auditor. See independence in non audit assurance work.

What should a customer check when it receives a report?

ISA (UK) 402 lists the points a user auditor considers, and they are a sensible checklist for any customer.

  • The period covered. Paragraph A32 says a type 2 report offers less evidence if there is little overlap with the customer’s financial year. Paragraph A35 says that if the testing period is completely outside the customer’s year, the auditor cannot rely on those tests without other procedures. Paragraph A33 adds that evidence may be needed about significant changes to controls outside the period covered.
  • Complementary user entity controls. These are controls the service organisation assumes its customers will operate, for example authorising transactions before sending them for processing (paragraph A36). Paragraph 17(b) requires the user auditor to check whether the customer has designed and implemented them. ICAEW’s glossary gives the example that excellent IT controls can be bypassed by someone finding a note of passwords left on a desk at the customer’s premises.
  • Subservice organisations. If the service organisation itself outsources part of the service, the report may use the inclusive method, which covers the subservice organisation’s controls, or the carve out method, which excludes them (paragraph A40). Where controls are carved out and relevant, the customer’s auditor has to address them separately.
  • Exceptions and modified opinions. Paragraph A38 says that exceptions or a modified opinion in a type 2 report do not automatically make it useless; they are considered in assessing the testing.
  • The service auditor. Paragraph 13 requires the user auditor to be satisfied about the service auditor’s competence and independence and about the adequacy of the standards used.

How might this work in practice?

Illustration only. An investment manager with a 31 March year end outsources fund accounting to an administrator. The administrator issues a type 2 report for the calendar year to 31 December. Nine months of the manager’s year are covered by testing. The manager’s auditor reads the report, notes two exceptions in reconciliations and checks how the administrator responded. It then asks the administrator, through the manager, whether any significant changes to controls happened between January and March, and tests the manager’s own complementary controls, such as checking that only authorised staff can send trade instructions. The report’s description shows that custody is carved out to a bank, so the auditor obtains separate evidence over custody.

What does it mean for the customer’s own audit report?

Paragraph 21 of ISA (UK) 402 says the user auditor shall not refer to the work of a service auditor in an unmodified audit report unless law or regulation requires it. Responsibility for the audit opinion stays with the company’s own auditor. If the auditor cannot obtain sufficient appropriate evidence about the outsourced services, paragraph 20 requires it to modify the opinion. See audit opinions and how a statutory audit works.

What mistakes come up most often?

  • Treating a type 1 report as evidence controls worked all year. It speaks only to design at a date.
  • Ignoring complementary user entity controls. The service organisation’s controls may only work if the customer does its part.
  • Missing a carve out. A report that excludes a subservice organisation leaves a gap the customer must fill.
  • Assuming anyone can have a copy. ICAEW explains that the intended recipients are existing customers with a direct contractual relationship. Others in the supply chain may need to negotiate access, and customers should confirm when contracting whether they are entitled to a report.
  • Accepting the wrong report. A SOC 2 or a report on a different service may not cover the processing that affects the customer’s accounts.

Controls reports sit alongside, not instead of, a company’s own controls; see internal controls for small businesses and internal audit vs external audit.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.