ISAE 3402 assurance report on controls at a service organisation
The international standard for an independent accountant's report on a service provider's controls relevant to customers' financial reporting; the equivalent of SOC 1 outside the US.
- 4requirementsin our own words
- 1edition ISAE 3402 (as in IAASB 2013 handbook)
- 0places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is voluntary in the 30 places assessed. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| All 30 places | Applies | Voluntary In force | Sector: customers whose financial reporting depends on the service No law in this country requires it; customers, lenders or tenders decide. | Not stated |
What it asks for
4 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Describe the system and the services covered, and state control objectives relevant to customers' financial reporting. | Management description of the system Policy, checked by document review | Compliance manager | Every year Governance, a system or service |
| Operate the stated controls throughout a Type 2 period. | Control operation evidence Record, checked by document review | Quality | Continuous Governance, a system or service |
| Treat subservice organisations as inclusive or carved out and monitor their controls. | Subservice assessment Contract, checked by document review | Procurement | Every year Governance, a system or service |
| Obtain the service auditor's report and manage its distribution and exceptions. | Report, exception log, remediation Record, checked by document review | Compliance manager | Every year Contractual, the organisation |
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| ISAE 3402 (as in IAASB 2013 handbook) | Current Current handbook edition is the 2026 IAASB Handbook (published 30 Sep 2026). | Not stated | 15 Jun 2011 | None named |
Stages, levels and report types
What each one is, how long it is valid, and the claim you may make once you hold it.
| Stage or level | Report or award | Period and validity | What you may say |
|---|---|---|---|
| Type 1 | assurance report (ISAE 3402) | as of one datereport covers a date | Say: ISAE 3402 Type 1 report as of DATE. |
| Type 2 | assurance report (ISAE 3402) | a specified periodreport covers a period | Say: ISAE 3402 Type 2 report for the period FROM-TO. |
About the programme
- Assessed by
- An independent auditor
- Scope
- service or system of a service organisation
- Levels
- Type 1 and Type 2
- Validity
- A report covers a date or period; no certificate expiry.
- Accreditation route
- none: professional accountants under national auditing regulators
- Who asks for it
- Financial-sector clients, Enterprise and colocation customers, Wholesale and hyperscale customers
- Where it is used
- global (widely used in Europe)
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.