December 2009

Basis for Conclusions: ISAE 3402, Assurance Reports on Controls at a Service Organization
Prepared by the Staff of the International Auditing and Assurance Standards Board

BASIS FOR CONCLUSIONS: ISAE 3402, ASSURANCE REPORTS ON CONTROLS AT A SERVICE ORGANIZATION This Basis for Conclusions has been prepared by staff of the International Auditing and Assurance Standards Board (IAASB). It relates to, but does not form part of, International Standard on Assurance Engagements (ISAE) 3402, Assurance Reports on Controls at a Service Organization, which was approved by the IAASB in September 2009.1

Background
1. The IAASB commenced the project to develop ISAE 3402 in March 2006, at the same time the IAASB commenced revision of its International Standard on Auditing (ISA) 402.2 The project to develop ISAE 3402 was initiated for a number of reasons. Firstly, given the increased use of service organizations, and the increasingly complex relationship between service organizations and entities using them, the IAASB concluded that there was a need for an assurance standard to complement the planned revised ISA 402 such that reports prepared in accordance with ISAE 3402 are capable of providing appropriate evidence under the new ISA 402.3 Because an engagement to report on controls at a service organization is not an audit of historical information, the new standard needed to be an ISAE, i.e., an assurance standard, not an ISA. Secondly, the IAASB noted that several national standard setters had recently updated or developed corresponding standards or guidance, and several of them requested the IAASB to develop an international standard. Finally, the IAASB was of the view that issuing the ISAE would enhance the consistency of service auditor performance, and consequently the consistency of user auditor performance when a service auditors report is used as audit evidence in an audit of financial statements. The IAASB has consulted widely on its proposals. Significant proposals were discussed with the IAASB Consultative Advisory Group at various stages of developing the proposed ISAE. The IFAC Small and Medium Practices Committee commented on various drafts of the proposed ISAE. A joint meeting was held with the U.S. Auditing Standards Boards (ASB) task force that developed an exposure draft based on ED-ISAE 3402 to replace the U.S. ASBs extant Statement on Auditing Standard (SAS) 70.4 SAS 70 had been used in many jurisdictions, in the absence of an ISAE, as the standard for reports on controls at a service organization.

2.

3.

4.

5.

See minutes of the September 21-25, 2009 IAASB meeting at http://www.ifac.org/IAASB/MeetingFileDL.php?FID=5133. ISA 402, Audit Considerations Relating to Entities Using Service Organizations. ISA 402, Audit Considerations Relating to an Entity Using a Service Organization, was released by the IAASB in March 2009. Statement on Auditing Standards 70, Service Organizations, as amended.

2 3

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

6.

In December 2007, the IAASB issued an exposure draft of proposed ISAE 34025 (EDISAE 3402). The comment period for the exposure draft ended May 31, 2008. The IAASB received forty-seven comment letters from a variety of respondents, including regulators and oversight authorities, IFAC member bodies, national auditing standard setters, audit firms, and professional and public sector organizations. The IAASB also solicited the views of service organizations on the key proposals contained in the exposure draft. The IAASB made changes to ED-ISAE 3402 as a result of the comments received. This Basis for Conclusions explains the more significant issues raised by respondents on ED-ISAE 3402, and how the IAASB has addressed them.

7.

Scope
Assertion-Based Engagements 8. In the Explanatory Memorandum to ED-ISAE 3402, the IAASB requested views on the proposal that the ISAE be written for application to assertion-based engagements6 where the service organization confirms, in a statement accompanying the description of the system that is made available to intended users, that the description of the system is fairly presented, the controls are suitably designed and, in the case of a Type B7 report, the controls have operated effectively. In particular, the IAASB asked whether there are situations in which it would not be possible or practicable for a service organization to provide an assertion. A large majority of respondents supported this proposal. Some of those made additional suggestions or comments, including that the ISAE should include an expectation that the service organization has a reasonable basis for the assertion it makes. A number of respondents also suggested that the IAASB should provide guidance for use by service organizations on the nature and extent of the work needed to support its assertion (or should initiate discussions with other organizations who may provide such guidance). Related to this was the question raised by some respondents of whether the service organization, when making its assertion, is entitled to rely on the work undertaken by the service auditor. Another suggestion by some respondents was that the ISAE should make it clear whether direct reporting engagements: (a) should not be undertaken at all; (b) should only be undertaken in certain circumstances (e.g., when required by law or regulation); or (c) may be undertaken at the auditors discretion (and, if undertaken, what standard applies). A respondent, while supporting the proposal, expressed concern that it may be difficult for service organizations to implement and may lead to boilerplate assertions, which it saw
Proposed ISAE 3402, Assurance Reports on Controls at a Third Party Service Organization. Assertion-based engagements are contrasted with direct reporting engagements in paragraph 10 of the International Framework for Assurance Engagements. In finalizing ISA 402, the IAASB agreed that it would be appropriate to change the terms Type A and Type B reports to type 1 and type 2 reports. ISAE 3402 also now uses type 1 and type 2 reports, to be consistent with the ISA. For purposes of this Basis for Conclusions, however, the terms Type A and Type B reports are used to be consistent with ED-ISAE 3402.

9.

10.

11.

5 6

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

as being of little value to users. The respondent felt strongly that the ISAE should not be finalized without further confirmation from service organizations that the proposals are practicable. 12. A few respondents did not support the proposal. The main reason offered by some was that it may discourage use of ISAE 3402 in certain jurisdictions where assertion-based engagements are not prevalent. ED-ISAE 3402 was sent to thirty-seven service organizations identified by IAASB members, firms and member bodies around the world, five of which responded. One of the five supported the proposal, one did not comment on it, and three did not support the proposal. The main reason provided by these three was that an explicit statement by the service organization would not add substantial value, particularly given the fact that the service auditors assurance would be based upon the same criteria as the assertion by the service organization. It was also argued that providing an assertion may, however, increase costs to service organizations if it requires them to perform detailed testing in addition to the testing conducted by the service auditor. The requirement for an assertion was also perceived as an attempt to transfer liability to the service organization without a reduction in service auditors fees. Further, a concern was expressed about who in the service organization should sign the assertion, and whether in some cases, for example where a service is provided internationally, any individual within the service organization would be in a position to publicly accept responsibility. Finally, it was also argued that service organizations often operate controls designed or selected by, or under the specific instruction of, customers, and in these cases, the customer, not the service provider, typically has contractual and other responsibilities for the design of the controls and their operating effectiveness. It would therefore be inappropriate in these cases to require the service organization to provide such an assertion.

IAASB Decision 13. The IAASB is of the view that an assertion-based engagement appropriately reflects the accountability relationship between the service organization and user entities through an explicit acknowledgement by the service organization of its responsibilities for the information presented, the design of the system and, in the case of a Type B report, the operating effectiveness of controls. This view is not altered by the fact that the service auditors assurance is based upon the same criteria as used by the service organization. An assertion-based assurance conclusion always uses the same criteria that the preparer of the assured information used to generate that information. This is an essential part of how assurance adds credibility to reported information. The IAASB also considers that explicitly stating, in the assertion, the criteria used by the service organization assists users in understanding how the service organization has determined that, for example, relevant information has not been omitted or distorted in preparing the description, and that the risks that threatened achievement of the control objectives stated in the description have been identified and dealt with. Further, explicitly stating the criteria in the service organizations assertion provides context for the service auditors opinion; as the International Framework for Assurance Engagements (the Assurance Framework) notes: Without the frame of reference provided by suitable criteria,

14.

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

any conclusion is open to individual interpretation and misunderstanding.8 15. The ISAE was not intended to apply when the service organization is not responsible for the suitable design of controls. This was not, however, sufficiently clear in ED-ISAE 3402. In response to comments received, this has now been made clear in paragraph 3 of the ISAE. Further, paragraph A2 of the ISAE now explains that, because of the inextricable link between the suitable design of controls and their operating effectiveness, the absence of an assertion with respect to the suitability of design will likely preclude the service auditor from concluding that the controls provide reasonable assurance that the control objectives have been met and thus from opining on the operating effectiveness of controls. Alternative services that may be appropriate in such circumstances are noted in paragraph A2 of the ISAE. The IAASB considered whether the ISAE should explicitly prohibit, in all cases, direct reporting engagements under ISAE 30009 with respect to controls at a service organization. The IAASB concluded that an explicit prohibition would not be appropriate because, for example, direct reporting may be required by law or regulation, or may be appropriate when the intended user of the assurance report is someone other than user entities and their auditors. However, to discourage inappropriate use of direct reports under ISAE 3000, the IAASB included wording in paragraph A11 stating A request to change the scope of the engagement may not have a reasonable justification when, for example, the service organization will not provide the service auditor with a written assertion and the request is made to perform the engagement under ISAE 3000. The IAASB also noted that the market would provide a natural mechanism to prevent inappropriate use of direct reporting under ISAE 3000 because such reports would likely be considered with less credibility than reports under ISAE 3402 in the absence of unusual circumstances to justify such an approach. The IAASB agreed with the respondents who suggested that the ISAE should include an expectation that the service organization should have a reasonable basis for the assertion it makes. The requirement in paragraph 13(b)(ii) of the ISAE was introduced to address this. The application material to this requirement (paragraph A9) makes it clear, however, that the service organizations assertion need not be based on a separate evaluation. The assertion may be based on ongoing monitoring activities that are often built into the normal recurring activities of a service organization including, for example, regular management and supervisory activities, internal audit activities and using information communicated by external parties, such as customer complaints and regulator comments. Paragraph A9 also makes clear the fact that the service auditors report on the operating effectiveness of controls is not a substitute for the service organizations own processes to provide a reasonable basis for its assertion. The IAASB noted that in a direct reporting engagement the service auditor would ordinarily obtain a written representation from the service organization regarding the same matters that would be included in the assertion. The IAASB is of the view, therefore, that requiring an assertion should not increase costs as the service organization would be
Assurance Framework, paragraph 35. ISAE 3000, Assurance Engagements Other than Audits or Reviews of Historical Financial Information.

16.

17.

18.

8 9

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

expected to have a reasonable basis for its representations, and similar work should be undertaken by the service organization to obtain this as for an assertion. Similarly, the IAASB is of the view that the person or persons with authority to provide the requested written representations could also approve the assertion. The IAASB, however, has amended the ISAE to remove any implication that may have existed that the assertion as presented to user entities needed to be signed in the name of an individual. 19. With respect to the view of a few respondents that requiring an assertion may discourage use of ISAE 3402 in certain jurisdictions where assertion-based engagements are not prevalent, the IAASB notes that the U.S. is the primary jurisdiction where assertion-based engagements for service organizations are not prevalent. In November 2008, the U.S. ASB issued an exposure draft of a Proposed Statement on Standards for Attestation Engagements (SSAE), Reporting on Controls at a Service Organization, which includes a proposal to limit reports on controls at service organizations to assertion-based engagements. Once finalized, this SSAE will supersede SAS 70 with respect to service auditors reports. Discussions with the U.S. ASB task force up to September 2009 when the IAASB approved ISAE 3402 indicated that responses to the U.S. ASBs exposure draft support assertion-based engagements.

Controls other than Financial Controls 20. With the purpose in mind of having ISAE 3402 complement ISA 402 in so far that reports prepared in accordance with ISAE 3402 are capable of providing appropriate evidence under ISA 402, ED-ISAE 3402 was written for use with respect to controls that are likely to be relevant to user entities financial reporting. ED-ISAE 3402 also stated that it may be applied, adapted as necessary in the circumstances of the engagement, for engagements to report on other controls at a service organization, for example, controls that affect user entities regulatory compliance, production or quality control (non-financial controls). Several respondents noted their view that an ISAE specifically written for application to financial reporting controls should not simply state that it can be adapted as necessary for engagements to report on non-financial controls unless specific guidance is included on how it should be adapted. Alternatively, ISAE 3402 should completely exclude engagements to report on non-financial controls and a separate ISAE should be developed to deal with such engagements.

21.

IAASB Decision 22. The IAASB agreed with respondents that ISAE 3402 should not simply state that it can be adapted as necessary for engagements to report on non-financial controls, and that such engagements should be ordinarily conducted under ISAE 3000. A number of options were discussed for dealing with engagements to report on non-financial controls at a service organization. One option was to include guidance in ISAE 3402 aimed specifically at assisting service auditors in conducting such engagements under ISAE 3000. It was decided, however, that given the wide variety of services and controls a service auditor may be asked to report on, any such guidance that is brief enough to be incorporated in this ISAE would likely be so generic as to be of very limited or no practical use.
6

23.

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

24.

The second option was to state that the ISAE does not deal with assurance engagements to report separately on non-financial controls, but that an engagement performed in accordance with ISAE 3402 to report on financial reporting controls may sometimes also include within its scope other controls that are closely related to those financial reporting controls (for example, controls related to regulatory compliance). It was noted that combined engagements such as these are common in certain jurisdictions, and that to exclude closely related controls may necessitate the preparation of a two-part assurance report, or two separate assurance reports. The IAASB was concerned, however, that introducing the concept of closely related controls may have unintended consequences, such as ISAE 3402 being used more extensively than intended for engagements for which it was not designed and potentially not well-suited. The IAASB agreed, therefore, to restrict the use of ISAE 3402 to those engagements where the controls being reported on are likely to be relevant to user entities financial reporting. As part of this, additional guidance was introduced in paragraph A1 of the ISAE stating that the determination of whether controls at a service organization related to operations and compliance are likely to be relevant to user entities internal control as it relates to financial reporting is a matter of professional judgment, having regard to the control objectives set by the service organization and the suitability of the criteria. That guidance notes that controls related to a service organizations operations and compliance objectives may be relevant to a user entities internal control as it relates to financial reporting because they may pertain to assertions about presentation and disclosure relating to account balances, classes of transactions or disclosures, or to evidence that the user auditor evaluates or uses in applying auditing procedures. For example, a payroll processing service organizations controls related to the timely remittance of payroll deducti ons to government authorities may be relevant to a user entity as late remittances could incur interest and penalties that would result in a liability for the user entity. Similarly, a service organizations controls over the acceptability of investment transactions from a regulatory perspective may be considered relevant to a user entitys presentation and disclosure of transactions and account balances in its financial statements.

25.

Shared Service Centers 26. ED-ISAE 3402 was written for third-party service organizations. It also stated that it may be applied, adapted as necessary in the circumstances of the engagement, for engagements to report on controls at a shared service center, which provides services to a group of related entities. Several respondents noted their view that an ISAE specifically written for application to third-party service organizations should not simply state that it can be adapted as necessary for engagements at a shared service center unless specific guidance is included on how it should be adapted. Alternatively, ISAE 3402 should completely exclude engagements at a shared service center and a separate ISAE should be developed to deal with such engagements.

27.

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

IAASB Decision 28. The statement regarding shared service centers in ED-ISAE 3402 paralleled a similar statement in ED-ISA 402.10 The IAASB deliberated this matter with respect to ED-ISA 402 and agreed in that case that the paragraph relating to the applicability of the ISA to shared service centers should be deleted.11 It was suggested that this matter could be a topic for a separate project in the future. To parallel this decision, and consistent with the comments received from respondents, the statement regarding shared service centers has been deleted from ISAE 3402.12

29.

Requirements
Suitable Criteria 30. The existence of suitable criteria is a prerequisite for any assurance engagement. For an assurance engagement to report on controls at a service organization, suitable criteria are required for evaluating whether the description of the system is fairly presented, whether the controls are suitably designed and, in the case of a Type B report, whether the controls have operated effectively. To ensure an appropriate level of consistency in relation to the suitability of criteria when applying the proposed ISAE, ED-ISAE 3402 included in the proposed requirements the minimum elements of suitable criteria. The Explanatory Memorandum to ED-ISAE 3402 specifically asked for respondents views on these proposed requirements. Most respondents commented on this matter and, of those who commented, most supported the minimum elements, either as stated, or with some changes to improve the wording, including: A few respondents thought that the criteria for evaluating whether the description of the system is fairly presented should be more explicit about the completeness of the control objectives identified in the description. Some respondents suggested the minimum elements should be more directly tied back to the characteristics of suitable criteria noted in the Assurance Framework.13 32. The remaining respondents who commented on this matter offered a range of individual comments and suggestions for changes, including that the minimum elements:
Exposure Draft of proposed ISA 402 (Revised and Redrafted), Audit Considerations Relating to an Entity Using a Third-Party Service Organization. A summary of the IAASBs discussion is included in the Basis for Conclusions: ISA 402 (Revised and Redrafted), Audit Considerations Relating to an Entity Using a Service Organization at http://web.ifac.org/clarity-center/isa-402. The IAASB also decided that other decisions made with respect to ISA 402 should be adopted in ISAE 3402 where relevant, for example, changing the terminology of Type A and Type B reports to type 1 and type 2 reports. Paragraph 36 of the Assurance Framework identifies the following characteristics: relevance, completeness, reliability, neutrality, and understandability.

31.

10

11

12

13

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

Do not adequately cover user-designed controls. Are too vague, boilerplate, theoretical or transaction-oriented. Should focus more on control objectives, and be clearer regarding the relationship between risks, control objectives and criteria. Should require discrete descriptions of services that are not homogeneous. Should, with respect to the criteria for evaluating whether the description of the system is fairly presented, clearly address each of the following elements separately: the services covered, the period to which the description relates, the control objectives, and related controls; and should exclude the control environment, risk assessment, and the information system. IAASB Decision 33. With respect to the completeness of the control objectives identified in the description, the IAASB noted that the ISAE is aimed at engagements where the service organizations description of its system is intended to meet the needs of a broad range of users and user auditors, rather than the specific needs of any individual user or user auditor. Therefore, while the service auditor may be aware of the assertions commonly embodied in user entities financial statements, the service auditor ordinarily will not be able to determine how controls at a service organization specifically relate to the assertions embodied in individual user entities financial statements and cannot, therefore, determine whether control objectives are complete from the viewpoint of individual user entities or user auditors. This matter is discussed in paragraph A23 of the ISAE. It is the responsibility of individual user entities or user auditors to assess whether the service organizations description addresses the particular control objectives that are relevant to their needs. The IAASB believes this reflects the reality of service organization engagements, and the underlying substance of user auditors responsibilities in accordance with ISA 402. The IAASB is of the view that criteria encompassing the minimum elements of suitable criteria identified in paragraphs 16-18 of the ISAE will, in the absence of unusual circumstances, exhibit the characteristics of suitable criteria noted in the Assurance Framework. The IAASB did not consider it necessary to more explicitly tie the minimum elements in the ISAE back to the characteristics in the Assurance Framework. This was because paragraph 5 of the ISAE states that The Assurance Framework, which defines and describes the elements and objectives of an assurance engagement, provides the context for understanding this ISAE and ISAE 3000, and paragraph 15 of the ISAE, which serves as a lead in to the requirements containing the minimum elements, includes a reference to paragraph 19 of ISAE 3000, which in turn refers to the relevant paragraph of the Assurance Framework. The IAASB reevaluated the requirements regarding suitable criteria in light of the other comments received, and did not consider major changes suggested by individual respondents to be warranted, although some changes were made that address a number of the concerns raised. For example: as mentioned previously, it is now clearer in the ISAE that it does not apply when the service organization is not responsible for the design of controls; and, the minimum elements of suitable criteria for evaluating whether the description of the system is fairly
9

34.

35.

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

presented, which were originally based on ISA 315,14 have been amended to be less transaction-oriented (see paragraph 16 of the ISAE). 36. The IAASB also discussed at some length how the ISAE depicts the relationship between risks, control objectives and criteria, including whether the identification of risks leads to the formulation of control objectives or whether risks are identified after control objectives have been determined. The IAASB made a number of changes to ISAE 3402 as a result of this discussion, in particular the way the relationship is explained in paragraphs 13(b)(iv), 17 and 18, and new paragraph A10 of the ISAE. Also, following further explanation from the respondent who raised this matter, the IAASB discussed whether the ISAE should reflect the following process advocated by the respondent: (a) (b) (c) 38. The service organization should identify the risks that could jeopardize the reliability of the services being provided. The service organization should then develop control objectives for each of those risks. The adequacy of the design of the controls should be evaluated in the context of the significance of the risks identified.

37.

While the IAASB agrees that (a) and (b), which imply a formal, sequential risk analysis, may describe how some service organizations could go about developing control objectives, the IAASB did not support requiring such an approach because, apart from the fact that the IAASB does not have a mandate to require management to take particular actions, the approach described is not the only way control objectives can be developed. It is common, for example, for risks and control objectives to be identified in an iterative way, rather than as outlined above. As stated in paragraph A10 of the ISAE: The service organization may have a formal or informal process for identifying relevant risks. A formal process may include estimating the significance of identified risks, assessing the likelihood of their occurrence, and deciding about actions to address them. However, since control objectives relate to risks that controls seek to mitigate, thoughtful identification of control objectives when designing and implementing the service organizations system may itself comprise an informal process for identifying relevant risks.

39.

The respondents comments also implied a concern about whether service organizations are responsible for identifying the risks that threaten achievement of the control objectives, or the risks that could jeopardize the reliability of the services being provided. In the IAASBs view, this is a semantic difference only if the control objectives are not achieved, then the reliability of the services will be jeopardized, and vice versa. Nonetheless, from the user auditors point of view, it makes more sense to think of risks in terms of the control
ISA 315, Identifying and Assessing the Risks of Material Misstatement through Understanding the Enti ty and Its Environment, paragraph 18.

14

PREPARED BY STAFF OF THE IAASB

10

BASIS FOR CONCLUSIONS: ISAE 3402

objectives rather than in terms of the service as a whole, because this is how user auditors evaluate which controls they seek to rely on. 40. There also appeared to be an underlying concern about the completeness of control objectives, and it was argued that the approach advocated would assist the service auditor in evaluating whether the control objectives identified by the service organization are complete. The IAASBs view regarding the completeness of control objectives is discussed in paragraph 33 of this Basis for Conclusions.

Disclosure of Sample Sizes 41. The Explanatory Memorandum to ED-ISAE 3402 requested views on the proposal that the description of tests of controls included in a Type B report should include the disclosure of sample sizes only when a deviation from controls is found. This approach is consistent with current practice in most jurisdictions. The rationale for this approach noted in the Explanatory Memorandum to ED-ISAE 3402 was as follows: The IAASB concluded that disclosure of sample sizes may not provide, on its own, sufficient information to the intended users to understand the judgments made by the service auditor in their determination; therefore, there might be a risk that intended users may misinterpret the significance of different sample sizes as they relate to user entities. The IAASB concluded, on the other hand, that disclosure of sample size when a deviation from controls is found provides intended users with relevant information as to the rate of deviation encountered in the sample. This information assists user auditors in the performance of their risk assessments. 42. Most respondents commented on this matter and, of those who commented, most supported the proposal. A significant minority, however, queried or disagreed with the IAASBs rationale for differentiating between cases when deviations are found and cases when they are not, as articulated in the Explanatory Memorandum. Some of these respondents suggested it may be helpful to include in the service auditors report details of the factors the service auditor used to determine the sample size.

IAASB Decision 43. The IAASB reconsidered this proposal in the light of respondents comments and discussed in detail the alternative proposal that for ISAE 3402 reports to be useful, in particular to user auditors, then both sample sizes and the factors and judgments made in their determination ought to be disclosed. The IAASB concluded that user auditors need to have information about the nature of the tests of controls the service auditor has performed to be able to make appropriate linkages with their own work at the user entity and thus have sufficient confidence that the tests performed provide sufficient appropriate audit evidence under ISA 402. It is therefore appropriate to retain the requirement to include details of tests performed in a Type B engagement. However, user auditors do not need to be informed of either the sample size or the factors
11

44.

45.

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

and judgments the service auditor considered in determining the extent of testing since, in the absence of a deviation being noted by the service auditor, user auditors are entitled to base their audit procedures on the premise that controls operated effectively for the stated period. Further, to detail in a meaningful way the factors and judgments considered and avoid boilerplate disclosures would be unnecessarily burdensome for the service auditor, and would unnecessarily increase the cost of engagements. 46. Information about the sample size and number of deviations is needed however when deviations are found; it informs user auditors of the rate of deviation, which assists them in performing their risk assessments under ISA 402.

Requirements Based on ISAs 47. The Explanatory Memorandum to ED-ISAE 3402 noted the IAASBs view that, because an engagement to report on controls at a service organization seeks to provide reasonable assurance and therefore is comparable to a financial statement audit, it would be desirable for the proposed ISAE, taken with ISAE 3000, to cover similar matters and at a similar level of detail to the ISAs to the extent practicable and relevant. Alternative ways to achieve this could include replicating or adapting relevant requirements from the ISAs when they are appropriate to the scope of the ISAE; or requiring that all ISAs be applied, adapted as necessary in the circumstances of the engagement. The IAASB did not consider it appropriate to require that all ISAs be applied, adapted as necessary in the circumstances of the engagement. Therefore, in preparing ED-ISAE 3402, the IAASB included a number of requirements based on ISAs dealing with matters such as using the work of the internal audit function, sampling, documentation, and using the work of a service auditors expert. The Explanatory Memorandum to ED-ISAE 3402 asked respondents to comment on this approach, including whether all relevant matters from the ISAs have been addressed, and whether these matters should ultimately be dealt with in ISAE 3402, or in ISAE 3000 when it is next revised. Nearly all respondents commented on this proposal, and nearly all of those who did believed the requirements included were generally appropriate, although some respondents identified particular requirements that in their view were not covered in ED-ISAE 3402 which they thought should be, or which they thought should be dealt with in more detail than they currently are. Most respondents mentioned that relevant topics should be dealt with in ISAE 3402 for the time being, but that topics with generic application to assurance engagements should be moved to ISAE 3000 when it is revised. A few respondents believed that the requirements of the ISAs could be included in the requirements of the ISAE by reference only (e.g., the service auditor should apply ISA XXX, adapted as necessary in the circumstances of the engagement); a few, including a body representing regulators, thought a far greater number of requirements adapted from the ISAs, and their associated application material, should be included in the ISAE; and one thought that service auditors who are familiar with ISAs would recognize their utility
12

48.

49.

50.

51.

52.

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

as guidance without the need for the ISAE to cover the same topics to the same extent as in the ISAs. IAASB Decision 53. In the light of the comments received, the IAASB confirmed its view that it is not appropriate to include the requirements of ISAs in the requirements of the ISAE by reference only. To do so would not result in sufficient clarity as to which requirements of the ISAs should be applied or how they ought to be adapted. The Explanatory Memorandum to ED-ISAE 3402 noted that, at the time the exposure draft was issued, the ISAs were subject to redrafting, and in some cases revision, under the Clarity project, and that when that project had been completed the adapted requirements in the ISAE would be conformed to account for changes made to the final redrafted ISAs. The IAASB reviewed the nature and extent of all requirements and associated application material for conformity with the final redrafted ISAs and in light of suggestions from respondents regarding additional or modified requirements adapted from ISA requirements. In addition to changes made primarily to conform with the new wording of the final redrafted ISAs, changes made included the following: A new requirement was introduced at paragraph 12 of the ISAE for the service auditor to determine the appropriate person(s) within the service organizations management or governance structure with whom to interact where the ISAE requires the service auditor to inquire of, request representations from, communicate with, or otherwise interact with the service organization. This is to include consideration of which person(s) have the appropriate responsibilities for and knowledge of the matters concerned. This requirement was adapted from requirements in ISA 26015 and ISA 580.16 It was introduced to overcome any confusion that may arise from use of the term service organization rather than management or those charged with governance. A new requirement was introduced at paragraph 13(a)(i) to require the service auditor, before agreeing to accept or continue an engagement, to determine whether the service auditor has the capabilities and competence to perform the engagement. This requirement makes the ISAE more consistent with ISA 220.17 The requirement to request written representations that the service organization has disclosed to the service auditor certain matters of which it is aware (paragraph 38 of the ISAE) was expanded to include fraud, to make the ISAE more consistent with ISA 240.18 Similarly, a reference to fraud was introduced to the requirement at paragraph 56 of the ISAE regarding the service auditors other communication responsibilities. The IAASB considered whether the ISAE should include additional requirements in relation to fraud
15 16 17 18

54.

ISA 260, Communication with Those Charged with Governance , paragraph 11. ISA 580, Written Representations, paragraph 9. ISA 220, Quality Control for an Audit of Financial Statements. ISA 240, The Auditors Responsibilities Relating to Fraud in an Audit of Financial Statements, paragraph 39.

PREPARED BY STAFF OF THE IAASB

13

BASIS FOR CONCLUSIONS: ISAE 3402

or other intentional acts. In the context of a service organization, such acts are likely to be: (i) management of the service organization overriding one or more controls to achieve a desired outcome (for example, a control being overridden in order to achieve performance objectives), or (ii) personnel of the service organization not performing one or more controls that are needed to achieve a control objective. The IAASB believes that as part of the work effort otherwise required under ISAE 3402, such acts would be covered and that it is not necessary to include additional requirements that may suggest the service auditor is assuming responsibility for fraud in the context of a financial statement audit as covered under ISA 240. The requirement in paragraph 10 of ED-ISAE 3402 that in addition to this ISAE, the service auditor shall comply with ISAE 3000 was replaced with the following requirement which is adapted from ISA 200:19 The service auditor shall not represent compliance with this ISAE unless the service auditor has complied with the requirements of this ISAE and ISAE 3000. Given the infrequent use of experts on service organization engagements, the section of ED-ISAE 3402 that dealt with using the work of a service auditors expert was deleted as the IAASB agreed the material currently in ISAE 3000 is adequate to deal with this. 55. In finalizing ISAE 3402, the IAASB noted that ISAE 3000 is currently being revised, and that some conforming amendments to ISAE 3402 may be required when the revised ISAE 3000 is issued, particularly regarding the extent to which certain topics, such as internal audit and documentation, are covered in ISAE 3402. Those changes are not, however, expected to be substantive, for example, they are not expected to affect the work effort required of service auditors or the form of the service auditors report.

Restrictions on Use or Distribution of the Service Auditors Report 56. 57. Paragraph 56(f) of ED-ISAE 3402 included a proposed reporting requirement to identify the purpose(s) and intended users of the service auditors assurance report. Several respondents commented on this matter. Some recommended that the ISAE explicitly require restriction of the assurance report in all cases. Others argued for a more flexible, principles-based approach, noting that it is not always appropriate to restrict the service auditors report, and it would be contrary to established practice in some jurisdictions to do so. A respondent encouraged the IAASB to explicitly acknowledge in the ISAE that it is a wide-spread practice in jurisdictions where allowed by laws or regulations to include in the service auditors report reference to any liability arrangements agreed between the service auditor, the service organization and intended users, including confirmation of the purpose for which the service auditors report has been prepared and the basis on which other parties may use it. This respondent noted their view that such
ISA 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing, paragraph 20.

19

PREPARED BY STAFF OF THE IAASB

14

BASIS FOR CONCLUSIONS: ISAE 3402

wording is in the public interest as it guards against the possibility of unwarranted reliance on the report by prospective users. A further respondent, a service organization, noted that as part of their due diligence prior to signing a contract, potential clients often require evidence of controls. The evidence typically requested is an assurance report, which is typically provided on a for information only basis. IAASB Decision 58. The IAASB is of the view that the assurance report will only be useful to those who have a sound understanding of the subject matter of the engagement, that is, the service organizations system and how it has been used. The ISAE has been amended therefore to require the assurance report to include a statement that the report and, in the case of a Type B report, the description of tests of controls are intended only for user entities and their auditors, who have a sufficient understanding to consider it, along with other information including information about controls operated by user entities themselves, when assessing the risks of material misstatements of user entities financial statements. See paragraph 53(e) of the ISAE. A further issue discussed by the IAASB is what it means to restrict the assurance report. In particular, does including a statement identifying the reports intended user(s) and purpose(s), such as that in the preceding paragraph, constitute a restriction? Or is it necessary for the assurance report to go further than this and specifically state that it is not to be distributed to or used by anyone other than the intended users or used for any other purpose? Regardless how the word restrict may be interpreted in various jurisdictions, the IAASB considered it to be unnecessary in the case of ISAE 3402 to require the assurance report to specifically state that it is not to be distributed to or used by others or used for other purposes. However, in recognition of the fact that in some jurisdictions it is common practice to do this, paragraph A48 of the ISAE acknowledges that the service auditor may consider it appropriate to include wording that specifically restricts distribution of the assurance report other than to intended users, its use by others, or its use for other purposes.

59.

Specimen Control Objectives 60. The Explanatory Memorandum to ED-ISAE 3402 noted that the IAASB had discussed whether to include specimen control objectives in an appendix to the proposed ISAE. The IAASB took the view in finalizing ED-ISAE 3402 that any benefit of providing specimen objectives would be outweighed by the risk that they may be inappropriately used on engagements when objectives specific to the services provided by the service organization should be used. Several respondents noted their view that it would be helpful for the ISAE to: include specimen control objectives like those in certain national publications on service organization engagements; refer to externally developed objectives such as the IT Governance Institutes publication IT Control Objectives for Sarbanes-Oxley; or establish a mechanism for national bodies who develop specimen objectives to share them. These

61.

PREPARED BY STAFF OF THE IAASB

15

BASIS FOR CONCLUSIONS: ISAE 3402

respondents believe that accessible specimen control objectives could be an important step in helping to ensure consistent application of ISAE 3402 in practice. IAASB Decision 62. The IAASB intends that a service auditor be able to apply this ISAE with respect to any suitable set of control objectives used by a service organization. It is not the role of the IAASB to prepare, refer to, or endorse any specific objectives. The IAASB acknowledges, however, that some IFAC member bodies, national standard setters and others, such as the IT Governance Institute, develop specimen control objectives, the use of which could lead to more consistent application of ISAE 3402 in practice. This topic will therefore be raised at a future IAASB-National Standard Setters meeting to determine whether there is potential for collaboration between national standard setters, and perhaps others, to develop international implementation guidance that includes specimen control objectives.

Using the Work of an Internal Audit Function 63. Paragraph 25 of ED-ISAE 3402 required, in that part of a Type B service auditors report that includes the description of tests of controls and the results thereof, a description of the internal auditors work used by the service auditor, if any, and of the service auditors procedures with respect to that work. While a few respondents expressed their agreement with this requirement, indicating that it imposes an appropriate level of transparency, a similar number of other respondents expressed the opposite opinion. In their view, any mention of the work of internal audit runs the risk of being misinterpreted as an attempt to divide responsibility. They would therefore impose a restriction like that which applies to the part of the service auditors report containing the service auditors opinion and not mention the use of the internal auditors work.

64.

IAASB Decision 65. In deliberating this matter, the IAASB noted that, on one hand, disclosure of the internal auditors work used by the service auditor and of the service auditors procedures with respect to that work provides the transparency that allows individual users of the service auditors report to make up their own minds as to what importance, if any, the y attach to the fact that particular tests were performed by internal auditors. On the other hand, referring to the work of internal auditors appears to contradict the principle that the service auditor has sole responsibility for all elements of the assurance report and that responsibility is not reduced by the service auditors use of the work of internal audit. No part of the assurance report should in any way imply that this is not the case. Referring to the work of internal audit could mislead some readers into thinking that the service auditor does not accept sole responsibility for the service auditors conclusions reached on the basis of internal audit work. After further consideration, the IAASB concluded that it is not acceptable for a service auditor to appear to represent that he or she has performed tests of controls when this is not the case, and that the principle of transparency is sufficiently important in the case of the
16

66.

PREPARED BY STAFF OF THE IAASB

BASIS FOR CONCLUSIONS: ISAE 3402

description of tests of controls in a Type B report that the requirement should be retained. The IAASB noted that Type B reports are different from other assurance reports, in that they include a factual description of the tests of controls, in a separate part of the report, for the benefit of user entities and, in particular, user auditors. This fact, along with clear wording in the assurance report, should overcome the risk that readers would be misled into thinking the service auditor was dividing responsibility with the internal auditor. It was also noted that a similar requirement has existed in SAS 70 for some time and does not appear to have caused problems in practice. Further, it was noted that this level of transparency makes it is unnecessary for the ISAE to set limits on the extent to which a service auditor can use the work of the internal audit function because the extent is apparent to readers of the assurance report, and each reader will be able to act according to how they perceive the effect of such use. 67. It was also noted that the section of ISAE 3402 dealing with using the work of an internal audit function does not deal with instances when individual internal auditors provide direct assistance to the service auditor in carrying out audit procedures. A footnote to this effect, consistent with paragraph 2 of ISA 610,20 was introduced in response to comments by some respondents that indicated that ED-ISAE 3402 was not clear on this point.

Other Matters
Inclusive Method and Subservice Organizations 68. When a service organization uses another service organization to perform services, that other service organization is known as a subservice organization. A service organization may deal with the services provided by a subservice organization by including the subservice organizations control objectives and related controls in the service organizations description of its system, and in the scope of the service auditors engagement. This is called the inclusive method. In response to a call by several respondents for more guidance on implications of the inclusive method, the IAASB introduced paragraph A4 of the ISAE to clarify that, when the inclusive method is used, the service auditor is fully responsible for opining on all information about the subservice organization that is included in the description. The service auditor, therefore, will ordinarily require full access to the subservice organization, written representations from the subservice organization, etc. For this reason, the inclusive method is hardly, if ever, used unless the service auditor is also the auditor of the subservice organization.

Effective Implementation of New Standards 69. The IAASB plans to issue a number of new assurance standards in the next few years to deal with services currently provided by professional accountants in public practice as well as new or emerging services. In accordance with IAASBs strategic plan, the Board intends
ISA 610, Using the Work of Internal Auditors, is currently under revision by the IAASB. One of the issues under consideration is the extent of requirements or guidance, if any, that should be included in the ISA with respect to direct assistance.

20

PREPARED BY STAFF OF THE IAASB

17

BASIS FOR CONCLUSIONS: ISAE 3402

to seek feedback on the application of these standards within a reasonable period following their effective dates. As part of this process, feedback will be sought in 2013 from service organizations, service auditors, user entities, user auditors and others on their experiences with the implementation of ISAE 3402.

PREPARED BY STAFF OF THE IAASB

18