ISAE 3402
Manage your ISAE 3402 control framework in one platform
Centralize processes, risks, control objectives, controls, results and supporting evidence.
Iskera helps you structure and maintain internal controls, monitor their execution and prepare for ISAE 3402 assurance engagements.
Connect processes, controls and audit evidence
ISAE 3402 is an international assurance standard for controls at service organizations where services may affect their customers' internal control over financial reporting. Reports are intended for user organizations and their auditors.
Preparing for an engagement means documenting the system, control objectives and related controls, and demonstrating their design and, for Type II reports, their operating effectiveness.
Build a clear risk and control matrix
Document the processes, risks, control objectives and controls within your ISAE 3402 scope. Connect them in a consistent matrix that is easy to maintain and update.
- Complete overview of the control framework
- Controls linked to risks and processes
- An easily maintained control repository
Monitor control execution
Schedule controls, assign owners and track execution directly in the platform. Contributors record results and upload evidence. Stay on top of deadlines and outstanding controls without managing multiple spreadsheets.
Contributors record their results and upload evidence. Monitor outstanding controls and deadlines without multiplying spreadsheets.
- Centralized owners and deadlines
- Results recorded as work progresses
- Real-time control status
Centralize evidence and maintain an audit trail
Keep results, documents and supporting evidence linked to each control. Iskera AI helps retrieve relevant information, summarize results and identify missing evidence when preparing for audits.
Iskera AI helps find relevant information, summarize results and identify missing evidence ahead of assurance engagements.
- Evidence linked directly to controls
- Complete history of results
- AI-assisted evidence review
Stay in control throughout the year
Consolidate controls, exceptions, actions and deadlines in dashboards for control owners and management. Identify overdue controls, recurring issues and outstanding remediation before the audit.
Identify overdue controls, recurring exceptions and unresolved remediation actions before the audit.
- Consolidated control monitoring
- Alerts for upcoming deadlines
- Corrective actions tracked to closure
An ISAE 3402 framework that's easier to maintain and demonstrate
100%
of your controls and evidence managed in one environment
- 01
An always-up-to-date control matrix
Connect processes, risks, control objectives and controls in a consistent repository that stays easy to update.
- 02
Evidence that's easy to retrieve
Keep each result and supporting document linked to its control for a clear audit trail.
- 03
Faster audit preparation with AI
Review control results, identify areas requiring attention and generate initial summaries to speed up audit preparation.
- 04
Continuous exception tracking
Turn control exceptions into corrective actions and monitor them through to closure.
Build your ISAE 3402 framework in 3 steps
Document controls, organize their execution and centralize the evidence needed for ISAE 3402 assurance engagements.
01
Structure your control repository
Import existing processes, risks, control objectives, controls and documents.
Organize your matrix by activity, entity, service or control area.
02
Schedule and perform controls
Define control owners, frequencies and execution procedures. Contributors record results and attach supporting evidence.
03
Prepare for audits and maintain your framework
Identify completed controls, exceptions, missing evidence and outstanding actions. Keep the history needed to prepare for each reporting period.
Manage your ISAE 3402 framework day to day
From your existing control matrix to an operational ISAE 3402 framework
OTHER SOLUTIONS
Connect ISAE 3402 to your broader internal control framework
ISAE 3402 relies on processes, risks, controls, evidence and action tracking. Iskera connects them in a single environment.
See Iskera in action
See how to structure your control matrix, automate control tracking, centralize evidence and prepare for ISAE 3402 assurance engagements.
Latest resources
Frequently asked questions
ISAE 3402 is an international assurance standard covering controls at service organizations. It guides independent assurance engagements on controls relevant to user entities' internal control over financial reporting.
A Type I report addresses the system description and design of controls at a specified date. A Type II report also covers operating effectiveness over a defined period, including the service auditor's tests and results.
No. ISAE 3402 involves an assurance engagement and a report issued by a service auditor. It is not a management system certification comparable to ISO certification.
ISAE 3402 is relevant to service organizations whose services may affect their customers' internal control over financial reporting. The scope depends on the services provided, their impact and the needs of customers and their auditors.
You need a clear description of the system, control objectives, related controls and their design. For a Type II report, you must also demonstrate that controls operated effectively throughout the reporting period.
In Iskera, every control can be linked to its owner, due date, result and supporting documents. This makes evidence available throughout the year rather than having to reconstruct it when the audit starts.
Iskera helps structure processes, risks, control objectives, controls, results, evidence and action plans. However, the independent service auditor is responsible for the assurance report and conclusion, which depend on the actual control framework.