Deviation in an ISAE 3402 type 2 report: what does it mean?
A deviation in an ISAE 3402 type 2 report means the auditor found, in a tested sample, that a control did not work as described. It sits in the testing section of the report. It is not an automatic verdict of “failed”. How much it weighs depends on how often it occurred, which control it affects and what you did about it. You can read the difference between type 1 and type 2 on type 1 vs type 2. For what the auditor tests exactly, see the audit page. For where the testing section sits in the report, read the report requirements.
You cannot leave out a deviation. The report states what the auditor found during testing. What you control is how good your response to it is.
Why a type 2 report can contain deviations
Type 2 tests whether your controls worked over a period of time. The auditor selects samples from that period and checks for each sample whether the control was carried out. If the auditor finds that a control was not carried out, or was carried out differently from the description, they record a deviation.
This is also why a type 2 shows not only that you have a process, but how you carry it out in practice. A process that is perfect on paper but is skipped once a month will show up in the sample.
Example: a deviation at a payroll processor
Suppose the control is that a second employee approves every mutation above €500 before the payroll run starts. The auditor selects 25 mutations from the period and checks the approval for each one. For three mutations, the second approval is missing from the ticketing system, because the employee had given it by email.
That is a deviation in operating effectiveness. The auditor records it, with the number of affected samples and a description of what was missing. You get the chance to respond with what you have done: the email route is closed, an after-the-fact check has been added, and the work process has been adjusted.
| Element | Example from the report |
|---|---|
| Control | Mutations above €500 are approved by a second employee |
| Sample | 25 mutations over the period |
| Deviation | 3 of 25 mutations without demonstrable second approval |
| Management response | Approval only via the ticketing system, plus a check afterwards on all mutations in the month |
This figure is fictional and is there to show the structure. The auditor determines the actual sample and numbers.
Design deviation and operating deviation
It helps to separate two types of findings. They follow the three questions the auditor answers: is the description accurate, is the control suitably designed, and did it operate effectively? The distinction itself is a practical classification, not a term from the standard.
| Design deviation | Operating deviation | |
|---|---|---|
| What is wrong | The control is not well designed to address the risk | The control is well designed but was not carried out, or not carried out properly |
| Example | There is no check on changes to bank account numbers | The check exists, but the signature is missing in three samples |
| How you fix it | Redesign the control and update the description | Improve how it is carried out and gather evidence |
| Impact on the client | The risk is not covered, even if nothing went wrong | The risk is covered in theory, but not always in practice |
A design deviation can weigh more heavily, because better execution cannot fix it. In a type 1 report the focus is mainly on design. In a type 2 report, operating deviations come into play as well.
How to respond to a deviation
Your response can appear in the report, as additional information from management. The auditor does not give a judgement on it. It is the part you write yourself, and the part from which your client learns the most. Use this order:
- Acknowledge the deviation. Do not soften it, and do not point to “exceptional circumstances” without evidence.
- Find the cause. Why did it happen? An email as approval is not a process error but a design error.
- Describe the measure you took. Include the date and the person responsible.
- Prove that the measure works. Preferably over a period after the change, so the reader can see it was not a one-off.
- Discuss it with your auditor before the draft is finished. Then it is described correctly in the report, and the auditor does not have to guess.
A deviation that you have resolved is still a deviation in the report. Your response shows that you know the cause and have addressed it, and that is what clients want to know.
Common mistakes
- Playing down deviations. “That only happened once” tells the reader nothing. What matters is how many samples failed and what you did about it.
- A response without evidence. “We have improved it” is not a response. Show what is different now.
- Discussing it too late. If you hear about the deviation only when the final report is due, there is no time left to prepare a good response.
- Treating a design deviation as an operating error. Then the solution does not address the cause, and the problem returns the following year.
- Not informing clients. Clients who rely on the report need to know what has changed. Discuss this with your account manager.
Checklist after a deviation
Use this list as soon as the auditor reports a deviation, so you do not write the response under time pressure:
- Have I understood the sample and the deviation exactly, and is the factual description correct?
- Has the cause been established, and is it a design or an operating deviation?
- Have I taken a measure that removes the cause, not only the symptom?
- Do I have evidence that the measure works, and from which date?
- Have I discussed the response with the auditor before the draft is finished?
- Does my client know that there was a deviation and what I have done?
- Is the deviation included in my internal control plan for next year?
Frequently asked questions about deviations in ISAE 3402
Does a deviation mean the report has failed?
Not automatically. The report describes what the auditor found. Whether a deviation affects the opinion depends on its nature and extent, and on the auditor’s assessment, for example whether a control objective is no longer met as a result. Ask about this early, so you know where you stand.
Do I have to inform my clients separately about a deviation?
This is not mandatory, because the deviation is in the report that clients and their accountants read. A short explanation to your larger clients before the report is published does help to avoid surprises. The client’s accountant also takes the deviation into account in their own audit.
How do I prevent deviations in the next report?
Start with the cause analysis, and tighten evidence and process routes where they are weak. An internal control that runs every month catches many issues before the auditor arrives. See also the audit checklist for what belongs in the preparation.
Does an operating deviation weigh more over a longer period?
A longer period often means more samples, and therefore a greater chance of a deviation. How the period and the number of samples relate to each other is determined by the auditor. See the costs and timeline to read what a whole engagement costs.
More information
Deviations are linked to the report requirements, where the testing section and management’s response are described. Also read the system description, because a deviation you do not recognise in your description often points to a process that is described incorrectly.