When Does a U.S. Service Organization Need An ISAE 3402 Report?

SOC & Attestations | FAQs | SSAE 16 / ISAE 3402

The International Auditing and Assurance Standards Board’s (IAASB) International Standard on Assurance Engagements (ISAE) 3402, Assurance Reports on Controls at a Service Organization, became effective in 2011. The standard allows accounting firms to issue attestation reports on user entities’ internal control over financial reporting for service organizations that have international operations..

A U.S. certified public accounting firm cannot issue a standalone ISAE 3402 report. Rather, U.S. certified public accounting firms can issue a combined report on Statement on Standards for Attestation Engagements (SSAE) No. 16, based on standards set by the American Institute of Certified Public Accountants (AICPA), and the ISAE 3402. The AICPA utilized standards from the IAASB for the SSAE No. 16 standard, and so the standards for SSAE No. 16 reports include the standards required for an ISAE 3402 report.

It is not required for a U.S. service organization with international operations or clients to complete an ISAE 3402 report as long as their SSAE No. 16 report includes all required standards. The service organization has the option of disclosing that their report is a combination SSAE No. 16 and ISAE 3402 report, if they meet all the standards.

To learn more about the similarities and differences between SSAE No. 16 and ISAE 3402 reports, refer to this SOC FAQ document

About Schellman

Schellman is a leading provider of attestation and compliance services. We are the only company in the world that is a CPA firm, a globally licensed PCI Qualified Security Assessor, an ISO Certification Body, HITRUST CSF Assessor, a FedRAMP 3PAO, and most recently, an APEC Accountability Agent. Renowned for expertise tempered by practical experience, Schellman's professionals provide superior client service balanced by steadfast independence. Our approach builds successful, long-term relationships and allows our clients to achieve multiple compliance objectives through a single third-party assessor.