Advanced Auditing, Assurance and Professional Ethics · Prospective Financial Information and Other Assurance Services

SAE 3402: Assurance Reports on Controls at a Service Organisation

Updated 5 October 2026 · Fact-checked

SAE 3402 sets out how a service auditor gives a reasonable assurance report on controls at a service organisation. A Type 1 report covers design and implementation at a date. A Type 2 report also covers operating effectiveness over a period. Answer by naming the report type, the assertion, the criteria and the opinion.

Understand SAE 3402: Assurance Reports on Controls at a Service Organisation

Many entities outsource work such as payroll, custody of investments, IT hosting or loan servicing. The entity that outsources is the user entity. The business that performs the work is the service organisation. The user entity's financial statements depend on the service organisation's controls, but its own auditor cannot easily visit and test them.

SAE 3402 solves this. An independent practitioner, the service auditor, reports on the service organisation's controls. The user entity and its auditor (the user auditor) then rely on that report instead of each testing the same controls. It is a reasonable assurance engagement, and the report is meant for a restricted audience: user entities and their auditors.

The engagement rests on two documents prepared by the service organisation. The first is the description of the system: how services are provided, the processes, records, and the control objectives and related controls. The second is the management's written assertion. Management asserts that the description fairly presents the system, that the controls were suitably designed, and (for Type 2) that they operated effectively. The service auditor tests these assertions against suitable criteria.

There are two report types. Type 1 reports on the fairness of the description and the suitability of design of controls at a specified date. Type 2 reports on the same, plus the operating effectiveness of controls throughout a specified period. Type 2 needs tests of controls and the results are described in the report. Type 2 is more useful to user auditors because it gives evidence on operation, not just design.

If the service organisation uses another service organisation (a subservice organisation), the description either includes its relevant controls (inclusive method) or leaves them out and identifies them (carve-out method). Complementary user entity controls, which the user entity itself must operate, are also described.

Key rules to remember

Type 1 report: Description fairly presented + controls suitably designed, as at a specified date; No testing of operating effectiveness. Evidence is about design and implementation only.
Type 2 report: Description fairly presented + controls suitably designed + controls operated effectively, throughout a specified period; Requires tests of controls and a description of the tests and results.
Three opinion elements: Fair description, suitable design, operating effectiveness (Type 2 only); Each is assessed in all material respects against stated criteria.
Parties: Service organisation (provides) | User entity (outsources) | User auditor (audits user entity) | Service auditor (reports on controls); Management of the service organisation gives the assertion, not the service auditor.
Report use: Restricted to user entities and their auditors; Report should state that it is intended only for them.

How to solve SAE 3402: Assurance Reports on Controls at a Service Organisation questions

Use this order for any question on SAE 3402, whether it asks for a definition, a comparison or a case-based conclusion.

1Identify the parties: who is the service organisation, the user entity, the user auditor and the service auditor.
2Decide the report type from the facts: a single date means Type 1; a period with testing of operation means Type 2.
3State what management must provide: the description of the system and the written assertion on fair presentation, design and (Type 2) operating effectiveness.
4Name the criteria and the work the service auditor does: obtain evidence on the description and design, and for Type 2 test controls over the period.
5Apply the facts: check for carve-out or inclusive treatment of a subservice organisation, deviations found, and scope limits.
6Conclude with the opinion or the effect on the report, such as a qualified opinion for a design deficiency.
7Close with the use of the report: restricted to user entities and their auditors.

Quickest way: Date or period test

When to use it: When a question asks you to pick or compare report types in limited time.

Look for the time frame: a point in time means Type 1, a period means Type 2.
Ask whether controls were tested for operation. If yes, Type 2.
Write one line each on description, design and operation.
Add one line on management assertion and restricted use.
Finish with the user auditor's benefit: Type 2 gives more reliance.

Common mistakes in SAE 3402: Assurance Reports on Controls at a Service Organisation

Saying a Type 1 report gives assurance on operating effectiveness.
Students assume any controls report covers whether controls worked.
Fix: Type 1 covers description and design at a date only. Operating effectiveness appears only in Type 2.
Treating the service auditor as the user entity's auditor.
Both are called auditors, so the roles blur.
Fix: The service auditor reports on the service organisation. The user auditor audits the user entity and uses that report as evidence.
Saying the service auditor prepares the description of the system.
Students think the practitioner writes what they report on.
Fix: Management of the service organisation prepares the description and the assertion. The auditor evaluates them.
Writing that the report can be given to any third party.
Students confuse it with a general-purpose report.
Fix: State that it is for user entities and their auditors, who understand the system and the controls.
Ignoring the subservice organisation in a case.
Case facts mention it briefly and students skip it.
Fix: Say whether the carve-out or inclusive method is used and how the description reflects it.

Worked examples

Example 1

Pranav Payroll Services processes salaries for several companies. Mehta Ltd, a user entity, wants evidence that Pranav's payroll controls worked during the year ended 31 March 2027. Advise which report Mehta Ltd should ask Pranav to obtain from a service auditor (engaged by Pranav's management), and why a report as at 31 March 2027 on design only (Type 1) would not meet Mehta's need.

Show the solution

Parties: Pranav is the service organisation; Mehta Ltd is the user entity; the service auditor is engaged by Pranav's management and will report on Pranav's controls; Mehta's auditor is the user auditor. The report type is agreed with Pranav's management, so Mehta Ltd asks for the report it needs.
Mehta Ltd needs evidence about how controls worked over the year. A Type 1 report is as at one date and covers design only, so it would not meet this need.
Only a Type 2 report covers operating effectiveness over a period. Mehta Ltd should therefore ask Pranav to obtain a Type 2 report for the year ended 31 March 2027.
A Type 2 report requires the service auditor to test controls throughout the period and describe the tests and results.
Pranav's management must still give a description of the system and a written assertion covering fair presentation, design and operating effectiveness.

Answer: Mehta Ltd should ask Pranav's management to obtain a Type 2 report from the service auditor for the year ended 31 March 2027, because Mehta Ltd needs evidence on operating effectiveness. A Type 1 report at a date gives no assurance on that.

Example 2

A service auditor is engaged on a Type 2 report for Sigma Custody Ltd. Testing shows a key reconciliation control failed to operate in two months of the period. Management's assertion says controls operated effectively throughout. What should the service auditor consider in the report?

Show the solution

The Type 2 opinion covers operating effectiveness throughout the period, assessed in all material respects against the criteria.
The deviation means the assertion that controls operated effectively throughout is not supported for that control.
Assess whether the failed control affects achievement of a stated control objective. A key reconciliation likely does.
If the control objective was not achieved in all material respects, the opinion on operating effectiveness must be modified, for example qualified.
The report should describe the deviation within the tests of controls and results, so user auditors can plan their own procedures.

Answer: The service auditor should modify the opinion on operating effectiveness, probably qualified, because the assertion is not supported, and describe the deviation in the results of tests.

Exam tips

Always begin a comparison with the time frame: date for Type 1, period for Type 2.
In case questions, name the four parties from the facts before you answer. It earns easy marks.
Mention that management gives the assertion and prepares the description. Examiners often test who is responsible.
For MCQs, watch for options claiming Type 1 gives assurance on operating effectiveness. That is wrong.
End written answers with the restricted-use point and the benefit to the user auditor.

Practice questions from Prospective Financial Information and Other Assurance Services

SAE 3402: Assurance Reports on Controls at a Service Organisation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

SAE 3402: Assurance Reports on Controls at a Service Organisation: frequently asked questions

What is the difference between a Type 1 and Type 2 report under SAE 3402?

A Type 1 report covers the fair presentation of the description and the suitability of design of controls at a specified date. A Type 2 report covers the same, and also the operating effectiveness of controls throughout a specified period. Type 2 involves testing of controls.

Who is a service auditor and who is a user auditor?

The service auditor is the practitioner who reports on controls at a service organisation. The user auditor audits the financial statements of a user entity and may use the service auditor's report as audit evidence.

What is management's assertion in SAE 3402?

It is a written statement by the service organisation's management on whether the description fairly presents the system, the controls were suitably designed and, for Type 2, operated effectively. The service auditor evaluates it against criteria.

Who can use a service auditor's report?

It is intended for user entities and their auditors who have sufficient understanding of the system. Its use is restricted to them.