ISAE 3402: every control, and what you already have

114 controls 16 frameworks share controls with it International (IAASB); adopted identically in Australia, New Zealand, Singapore, India, Brazil, Thailand, Japan and elsewhere verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
ISO 22301:2019	2	measure it →
ISO/IEC 42001:2023	2	measure it →
ISO 13485:2016	2	measure it →
ISO 19011	1	measure it →
ISO 31000:2018	1	measure it →
ISO/IEC 23894:2023	1	measure it →
ISO 14001:2015	1	measure it →
ISO 14004:2016	1	measure it →
ISO 22000:2018	1	measure it →
ISO 27701:2019	1	measure it →
ISO 37001:2016	1	measure it →
ISO 37301:2021	1	measure it →

Every control

Code	Control	Also in
`ISAE3402-1`	Engagement Acceptance	0
`ISAE3402-2`	Materiality and Risk	0
`ISAE3402-3`	Evidence and Documentation	0
`ISAE3402-4`	Description of System	0
`ISAE3402-5`	Fair Presentation	1
`ISAE3402-6`	Complementary User Entity Controls	0
`ISAE3402-7`	Management Statement	0
`ISAE3402-8`	Control Objectives	0
`ISAE3402-T1-1`	Design of Controls at Point in Time	0
`ISAE3402-T1-2`	Service Auditor Opinion (Type I)	0
`ISAE3402-T2-1`	Operating Effectiveness (Min 6 Months)	0
`ISAE3402-T2-2`	Tests and Results	0
`ISAE3402-T2-3`	Service Auditor Opinion (Type II)	0
`ISAE3402.1`	Engagement Acceptance	0
`ISAE3402.10`	Complementary User Entity Controls (CUECs)	0
`ISAE3402.11`	Risk Assessment by Service Auditor	4
`ISAE3402.12`	Use of Internal Audit Work	0
`ISAE3402.13`	Subsequent Events	0
`ISAE3402.14`	Service Auditor Report Content	0
`ISAE3402.15`	Modified Opinions	0
`ISAE3402.16`	Documentation	1
`ISAE3402.17`	Quality Control	0
`ISAE3402.18`	Communication with Service Organisation	13
`ISAE3402.19`	Period Covered for Type 2	0
`ISAE3402.2`	Management Written Assertion	0
`ISAE3402.20`	Bridge Letters	0
`ISAE3402.21`	Restricted Use	0
`ISAE3402.3`	System Description	0
`ISAE3402.4`	Control Objectives	0
`ISAE3402.5`	Control Design Assessment (Type 1 and 2)	0
`ISAE3402.6`	Operating Effectiveness Testing (Type 2)	0
`ISAE3402.7`	Type 1 vs Type 2 Selection	0
`ISAE3402.8`	Carve Out Method	0
`ISAE3402.9`	Inclusive Method	0
`3402.10`	ISAE 3402 paragraph 10: ISAE 3000	0
`3402.11`	ISAE 3402 paragraph 11: Ethical Requirements	0
`3402.12`	ISAE 3402 paragraph 12: Management and Those Charged with Governance	0
`3402.13`	ISAE 3402 paragraph 13: Acceptance and Continuance	0
`3402.14`	ISAE 3402 paragraph 14: Acceptance of a Change in the Terms of the Engagement	0
`3402.15`	ISAE 3402 paragraph 15: Assessing the Suitability of the Criteria	0
`3402.16`	ISAE 3402 paragraph 16: Assessing the Suitability of the Criteria	0
`3402.17`	ISAE 3402 paragraph 17: Assessing the Suitability of the Criteria	0
`3402.18`	ISAE 3402 paragraph 18: Assessing the Suitability of the Criteria	0
`3402.19`	ISAE 3402 paragraph 19: Materiality	0
`3402.20`	ISAE 3402 paragraph 20: Obtaining an Understanding of the Service Organization's System	0
`3402.21`	ISAE 3402 paragraph 21: Obtaining Evidence Regarding the Description	0
`3402.22`	ISAE 3402 paragraph 22: Obtaining Evidence Regarding the Description	0
`3402.23`	ISAE 3402 paragraph 23: Obtaining Evidence Regarding Design of Controls	0
`3402.24`	ISAE 3402 paragraph 24: Obtaining Evidence Regarding Operating Effectiveness of Controls	0
`3402.25`	ISAE 3402 paragraph 25: Obtaining Evidence Regarding Operating Effectiveness of Controls	0
`3402.26`	ISAE 3402 paragraph 26: Obtaining Evidence Regarding Operating Effectiveness of Controls	0
`3402.27`	ISAE 3402 paragraph 27: Sampling	0
`3402.28`	ISAE 3402 paragraph 28: Nature and Cause of Deviations	0
`3402.29`	ISAE 3402 paragraph 29: Nature and Cause of Deviations	0
`3402.30`	ISAE 3402 paragraph 30: Obtaining an Understanding of the Internal Audit Function	0
`3402.31`	ISAE 3402 paragraph 31: Determining Whether and to What Extent to Use the Work of the Internal Auditors	0
`3402.32`	ISAE 3402 paragraph 32: Determining Whether and to What Extent to Use the Work of the Internal Auditors	0
`3402.33`	ISAE 3402 paragraph 33: Determining Whether and to What Extent to Use the Work of the Internal Auditors	0
`3402.34`	ISAE 3402 paragraph 34: Using the Work of the Internal Audit Function	0
`3402.35`	ISAE 3402 paragraph 35: Using the Work of the Internal Audit Function	0
`3402.36`	ISAE 3402 paragraph 36: Effect on the Service Auditor's Assurance Report	0
`3402.37`	ISAE 3402 paragraph 37: Effect on the Service Auditor's Assurance Report	0
`3402.38`	ISAE 3402 paragraph 38: Written Representations	0
`3402.39`	ISAE 3402 paragraph 39: Written Representations	0
`3402.40`	ISAE 3402 paragraph 40: Written Representations	0
`3402.41`	ISAE 3402 paragraph 41: Other Information	0
`3402.42`	ISAE 3402 paragraph 42: Other Information	0
`3402.43`	ISAE 3402 paragraph 43: Subsequent Events	0
`3402.44`	ISAE 3402 paragraph 44: Subsequent Events	0
`3402.45`	ISAE 3402 paragraph 45: Documentation	0
`3402.46`	ISAE 3402 paragraph 46: Documentation	0
`3402.47`	ISAE 3402 paragraph 47: Documentation	0
`3402.48`	ISAE 3402 paragraph 48: Documentation	0
`3402.49`	ISAE 3402 paragraph 49: Documentation	0
`3402.50`	ISAE 3402 paragraph 50: Documentation	0
`3402.51`	ISAE 3402 paragraph 51: Documentation	0
`3402.52`	ISAE 3402 paragraph 52: Documentation	0
`3402.53`	ISAE 3402 paragraph 53: Content of the Service Auditor's Assurance Report	0
`3402.54`	ISAE 3402 paragraph 54: Content of the Service Auditor's Assurance Report	0
`3402.55`	ISAE 3402 paragraph 55: Modified Opinions	0
`3402.56`	ISAE 3402 paragraph 56: Other Communication Responsibilities	0
`ASSERTION`	Appendix 1: the service organisation's assertion, and the service organisation's own duties the standard implies	0
`DEFINITIONS`	Paragraphs 1 to 9: scope, objectives and the defined terms, including type 1 and type 2 reports, the carve-out and inclusive methods and complementary user entity controls	0
`H01`	ISAE 3000 (paragraphs 10)	0
`H02`	Ethical Requirements (paragraphs 11)	0
`H03`	Management and Those Charged with Governance (paragraphs 12)	0
`H04`	Acceptance and Continuance (paragraphs 13)	0
`H05`	Acceptance of a Change in the Terms of the Engagement (paragraphs 14)	0
`H06`	Assessing the Suitability of the Criteria (paragraphs 15 to 18)	0
`H07`	Materiality (paragraphs 19)	0
`H08`	Obtaining an Understanding of the Service Organization's System (paragraphs 20)	0
`H09`	Obtaining Evidence Regarding the Description (paragraphs 21 to 22)	0
`H10`	Obtaining Evidence Regarding Design of Controls (paragraphs 23)	0
`H11`	Obtaining Evidence Regarding Operating Effectiveness of Controls (paragraphs 24 to 26)	0
`H12`	Sampling (paragraphs 27)	0
`H13`	Nature and Cause of Deviations (paragraphs 28 to 29)	0
`H14`	Obtaining an Understanding of the Internal Audit Function (paragraphs 30)	0
`H15`	Determining Whether and to What Extent to Use the Work of the Internal Auditors (paragraphs 31 to 33)	0
`H16`	Using the Work of the Internal Audit Function (paragraphs 34 to 35)	0
`H17`	Effect on the Service Auditor's Assurance Report (paragraphs 36 to 37)	0
`H18`	Written Representations (paragraphs 38 to 40)	0
`H19`	Other Information (paragraphs 41 to 42)	0
`H20`	Subsequent Events (paragraphs 43 to 44)	0
`H21`	Documentation (paragraphs 45 to 52)	0
`H22`	Content of the Service Auditor's Assurance Report (paragraphs 53 to 54)	0
`H23`	Modified Opinions (paragraphs 55)	0
`H24`	Other Communication Responsibilities (paragraphs 56)	0
`PART-A`	Conduct, ethics and acceptance (paragraphs 10 to 14)	0
`PART-B`	Criteria, materiality and understanding the system (15 to 20)	0
`PART-C`	Evidence on the description, the design and the operating effectiveness of controls (21 to 29)	0
`PART-D`	Internal audit, written representations, other information and subsequent events (30 to 44)	0
`PART-E`	Documentation and the assurance report (45 to 56)	0
`REPORTS`	Appendices 2 and 3: the illustrative unmodified and modified service auditor's assurance reports	0
`STANDARD`	ISAE 3402: scope, status, relationship to ISAE 3000, ISA 402 and AT-C 320, and what is held	0

Tell me when ISAE 3402 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for ISAE 3402, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition