Corrected October 30, 2026. The original publication date is retained.
This article originally compared wording in SSAE 16 and ISAE 3402 about intentional acts by service-organization personnel. Its conclusion went too far: a wording difference does not mean an ISAE 3402 auditor can ignore fraud or that a service organization faces no reporting consequences.
SSAE 16 has since been superseded. Any present-day comparison should use the requirements applicable to the actual engagement, not rely on this historical standard name.
What Does the International Standard Say?
The original IAASB ISAE 3402 standard addresses reporting consequences and communication of relevant matters. Paragraph 55 addresses modifications to the service auditor’s opinion. Paragraph 56 addresses communication when the auditor becomes aware of noncompliance, fraud or uncorrected errors attributable to the service organization that may affect user entities.
Those requirements do not support the earlier implication that intentional misconduct has no consequences under ISAE 3402. Nor should an exception automatically be described as a “failed report”; its effect depends on the facts and the applicable reporting requirements.
What Should a Customer Ask?
If a report identifies a significant issue, ask how it affects the service you use. Review the opinion, relevant test results, management’s response, and any additional evidence needed for your decision. The report label alone does not answer those questions.
Example Scenario: A customer sees an exception involving an approval bypass. It asks which transactions and period were affected, what corrective action occurred, and whether the issue changes its reliance on the control. It does not assume that every report under the same standard is unreliable.
For context on current report selection, see our U.S. and international service-organization reporting discussion and the AICPA SOC 1 overview.
One Response