The process begins with a description of the organisation and its relevant processes. A control matrix is then drawn up, setting out which risks could affect the client's financial statements and which controls mitigate them. These controls are subsequently tested by the Service Auditor — for their design (Type I) and, for a Type II report, for their operating effectiveness over a period of at least six months.

A Type I report assesses the design of the controls at a specific point in time: do the controls genuinely exist, not just on paper but in practice? A Type II report goes a step further, examining whether these controls have actually operated as described over a period of at least six months.

Primarily service providers whose processes are relevant to their clients' financial reporting — for example data centres, trust companies, or outsourcing partners serving banks, insurers, or pension funds. Within the financial sector, organisations need to be able to demonstrate that they are reliable and have their security firmly under control; confirmation from an external auditor gives these institutions the assurance they require.

Preparation usually takes several months. The underlying processes are often already in place, but a proper description may be missing, or the organisation may lack the discipline or specific measures required. Once implemented, a Type II report requires an observation period of at least six months. Overall, organisations should generally allow around eight to twelve months to reach the final Type II report, with Type I taking a few months less.

AAF 01/20 is the UK-specific technical standard issued by the Institute of Chartered Accountants in England and Wales (ICAEW), most commonly used by pension administrators, investment managers, and other financial services outsourcing providers in the UK. It shares much of the same structure and control-objective approach as ISAE 3402, and many UK service organisations now produce a single combined report covering both standards, giving clients assurance under a UK-recognised framework as well as an internationally recognised one.

ISAE 3402 is the international standard, while SOC 1 is its US counterpart, issued under AICPA guidelines. The two are closely aligned in content, and many reports today are prepared on a combined basis.

ISO 27001 certifies the information security management system as a whole, whereas ISAE 3402 provides an assurance statement on specific controls, addressed to a client or financial institution. The key practical difference lies in the depth of testing: under ISAE 3402, a remediation plan is often not sufficient if a control fails to exist or has not operated effectively within the six-month period. This results in an exception being noted in the report and may also affect the assurance opinion itself, which could then include a qualification or, in the most serious cases, an adverse opinion.