Which testing standard is currently used to guide Service Organization Control (SOC) audits outside the United States?

The International Standard on Assurance Engagements (ISAE) 3402, "Assurance Reports on Controls at a Service Organization," is the standard used for Service Organization Control (SOC) audits conducted outside the United States. It was developed by the International Auditing and Assurance Standards Board (IAASB) to provide an international equivalent to the American standard. ISAE 3402 enables service organizations to provide an independent auditor's report on their control environment to clients and their auditors, regardless of geographical location, ensuring a global standard for such assurance engagements.

A. The Statement on Standards for Attestation Engagements (SSAE) 18: This is the standard issued by the American Institute of Certified Public Accountants (AICPA) and is used for SOC audits within the United States.

B. The International Standard on Review Engagements (ISRE) 2400: This standard pertains to review engagements of historical financial statements, not assurance reports on controls at a service organization.

C. The Statement on Standards for Accounting and Review Services (SSARS) 25: This is an AICPA standard that addresses engagements to prepare and compile financial statements, which is a different scope than a SOC audit.

1. International Auditing and Assurance Standards Board (IAASB). (2019). Handbook of International Quality Control

Auditing

Review

Other Assurance

and Related Services Pronouncements. ISAE 3402

"Assurance Reports on Controls at a Service Organization

" Introduction

Paragraph 1.

2. American Institute of Certified Public Accountants (AICPA). (2018). Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting (SOC 1®). This guide frequently references ISAE 3402 as the international counterpart to the US SSAE 18 standard.

3. Boritz

J. E. (2011). ISAE 3402: A New International Standard for Assurance on Outsourcing. International Journal of Auditing

15(3)

336-340. https://doi.org/10.1111/j.1099-1123.2011.00436.x (This article explicitly discusses the development of ISAE 3402 as the international standard corresponding to the then-current US standard

SAS 70

which was later superseded by SSAE 16 and SSAE 18).