Reporting on Controls at a Service Organization

Status: Canadian Standard on Assurance Engagements (CSAE) 3416 approved.

Objective and Scope of this Project
Background
Issues
Activities to Date
Related Information
Contact Information

Objective and Scope of this Project

The objective of this project is to develop a Canadian Standard on Assurance Engagements (CSAE) for engagements to report on controls at a service organization. The project involves developing a Canadian equivalent to the Statement on Standards of Attestation Engagements (SSAE), Reporting on Controls at a Service Organization, being developed by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA).  The wording of the SSAE will be modified, where necessary, to meet unique Canadian circumstances.

The CSAE would replace Section 5970, Auditor’s Report On Controls At A Service Organization, and Assurance and Related Services Guideline AuG-42, Service Organizations that Use Other Service Organizations.

Background

The AASB is committed to adopting the International Standards on Auditing (ISAs), but not other international standards dealing with assurance and related services engagements. The IAASB developed International Standard on Assurance Engagements (ISAE) 3402, Assurance Reports on Controls at a Service Organization, which provides guidance to auditors who issue audit reports on the processing of transactions by a service organization for use by user entities and user entities’ auditors. ISAE 3402 was developed as a complement to ISA 402, Audit Considerations Relating to an Entity Using a Service Organization. ISA 402 has been adopted by the AASB as CAS 402, Audit Considerations Relating to an Entity Using a Service Organization.

Section 5970 and AuG-42 cover the same subject matter as ISAE 3402. However the Canadian standards are aligned with the AICPA’s Statement on Auditing Standard No. 70, Service Organizations (SAS 70). In Canada, both Section 5970 and SAS 70 are used extensively due to the integration of the Canadian and US markets for these types of engagements.

CAS 402 does not require a user entity auditor to use a service auditor’s report prepared under ISAE 3402. Such reports prepared under other recognized national standards (for example, Section 5970 or SAS 70) are acceptable. Therefore, adopting ISAE 3402 in Canada is not required to perform audits of user entity financial statements in accordance with the CASs.

The AASB obtained views of Canadian stakeholders to assist in deciding whether to adopt ISAE 3402 for use in Canada. Stakeholders expressed a strong view for maintaining consistency with US. (i.e., they felt ISAE 3402 should not be adopted unless the US did so as well).

In November 2008, the AICPA issued an exposure draft proposing an SSAE, Reporting on Controls at a Service Organization, to replace SAS 70. The SSAE is based on ISAE 3402. However, it has been modified wherever the AICPA deemed necessary to meet the needs in the US environment. The IAASB and the AICPA worked together to align their respective standards to the extent possible; however, there may likely remain substantive differences between the two final standards.

Based on the views of the Canadian stakeholders to maintain North American consistency, the AASB decided to develop a Canadian standard using the SSAE as a base, with modifications only where necessary to meet unique Canadian circumstances, rather than adopt ISAE 3402. To the extent that ISAE 3402 and the SSAE are harmonized, the proposed CSAE will also align, in most respects, with ISAE 3402.

Issues

Key issues that will be addressed in developing the CSAE include:

• How will consistency of standards on a North American basis for these types of engagements be maintained, while ensuring that unique Canadian circumstances are addressed?
• How will consistency of the CSAE with other Canadian assurance standards in the Handbook be achieved?

Activities to Date

In June 2010, the AASB reviewed comments received on the Exposure Draft and approved CSAE 3416.

In January 2010, the AASB approved the Exposure Draft.

In December 2009, the AASB reviewed a first draft of a CSAE based on the AICPA ASB’s proposed SSAE, Reporting on Controls at a Service Organization, modified where necessary to meet unique Canadian circumstances.  The SSAE used in preparing the first draft CSAE will be subject to review and revision by the AICPA’s ASB in their January 2010 meeting when it will be presented for a vote to approve it as a final standard.

In September 2009, the AASB reviewed and approved a project to develop a Canadian equivalent to the AICPA’s proposed SSAE, modified where necessary to meet unique Canadian circumstances and replace Section 5970 and AuG-42.  

In June 2009, the AASB reviewed the status of remaining differences between the IAASB’s ISAE 3402 and AICPA’s SSAE and discussed an approach to developing a CSAE.

In March 2009, a joint task force meeting between the IAASB and the AICPA’s ASB was held to explore areas where substantive differences between their respective standards could be eliminated.

In December 2008, the AASB reviewed the IAASB’s Issues Papers summarizing the substantive differences between ISAE 3402 and the AICPA’s proposed SSAE.

In May 2008, the AASB considered comments received from the Invitation to Comment and submitted their official response to the IAASB’s Exposure Draft of ISAE 3402.

In January 2008, the AASB agreed to issue an Invitation to Comment (ITC) to Canadian stakeholders requesting comments on the IAASB Exposure Draft of ISAE 3402 and on whether changes should be made to existing Canadian standards including the possibility of adopting ISAE 3402 for use in Canada.

The AASB provided input regarding the development of ISAE 3402 to the IAASB member nominated by the CICA.

Related Information

• Responses to the AASB on its Exposure Draft are available here.
• Exposure Draft
• Responses to the AASB on its Invitation to Comment are available here.
• Invitation to Comment
• The AASB’s official response to the IAASB’s Exposure Draft is available here.

Contact Information

Staff contact: P. Mary Olynik, CA
Telephone no.: +1 (416) 204 3312