Assurance on internal controls of services organisations (AAF 01/06)
TECH AAF 01/06 'Assurance reports on internal controls of service organisations made available to third parties' supports assurance engagements to provide comfort over the design, implementation and operating effectiveness of controls.
TECH 01/06 AAF is currently being updated. A consultation on proposed changes ended on 30 September 2019 and an ICAEW working group is now considering comments received. The revised technical release is due to published in January 2020. It will be effective for periods beginning on or after 1 July 2020 and early adoption will be encouraged.
Other helpful resources
- ICAEW’s Assurance resources
- A Framework for Assurance Reports on Third Party Operations (TECH 02/07 AAF)
- Assurance Engagements: Management of Risk and Liability (TECH 04/06 AAF)
- Access to controls reports at service organisations
This article provides a brief explanation of who should be able to view reports on internal controls of service organisations, and the assurance reports thereon, and how difficulties in arranging access can be overcome.
Previous updates to AAF 01/06
Since its first publication in 2006, a great deal of work has been done to support and surround AAF 01/06. The most significant developments are listed here.
Stewardship Supplement introduced in March 2011
The UK Stewardship Code was issued by the Financial Reporting Council in July 2011. The Stewardship Supplement to AAF 01/06 was released to assist asset managers to obtain an independent assurance report on their commitment to the UK Stewardship Code based on the framework set out in AAF 01/06. This guidance on assurance reporting focused on Principles 1, 2, 6 and 7 of the Code that were considered ‘objectively verifiable’ at the time of the release of the Supplement.
The FRC issued its revised UK Stewardship Code in September 2012, and ICAEW has revised the Stewardship Supplement in response.
Appendix 8 introduced November 2010
In November 2012 a new pro forma reporting accountants’ assurance report implementing International Standard on Assurance Engagements (ISAE) 3402 Assurance reports on Controls at a Service Organisations (issued by the IAASB in December 2009) was included in Appendix 8. To enable issuers to report on controls other than financial reporting controls, the report refers to ISAE 3000 in addition to ISAE 3402.
Appendix 1 expanded June 2009
In June 2009, ICAEW expanded Appendix 1 to add illustrative material for service providers who undertake investment administration, private equity management and hedge fund management (Appendix 1 (h)-(j)). Conforming changes to the existing control objectives for other sectors were also made (Appendix 1 (b) and (e)).
There was no change to the main body of the guidance.
ICAEW's assurance resource
This page is part of ICAEW’s online assurance resource, which replaces the Assurance Sourcebook.