International auditing standard for controls over outsourced processes.
ISAE 3402 (International Standard on Assurance Engagements 3402) governs how an independent auditor assesses and reports on the controls of a service provider. The report provides clients with assurance over outsourced processes, such as those in data centres, payroll, or IT. The key distinction lies in the type: Type 1 confirms that the controls are appropriately designed as of a specific date; Type 2 additionally examines whether they were actually effective over a period of time (typically six to twelve months). Type 2 therefore carries significantly more weight. The German equivalent is IDW PS 951.
For service providers with audit-relevant processes, an ISAE 3402 report is often a prerequisite, particularly with international clients. Many clients explicitly require Type 2, as Type 1 only covers a specific point in time — this should be clarified at an early stage. Around the report itself, clients ask numerous detailed questions that recur across inquiries. Those who can deliver the report along with consistent answers quickly will pass client audits without weeks of effort.
With Tendry, you keep your ISAE 3402 report and the accompanying responses centrally stored and readily accessible. This allows you to handle client questions relating to both Type 1 and Type 2 quickly and consistently.
Win Deals. Deliver Trust.
