What is ISAE 3402?

ISAE 3402 is an international standard for assurance reports on internal controls at a service provider. An independent auditor examines whether your processes and controls are well designed and, in a type 2, whether they operated over a period. The report is intended for your clients and their accountants, where the work you do for them affects their annual accounts. The standard comes from the IAASB , the international standard setter for accountants.

ISAE 3402 is not a certificate. You receive a report with an opinion from an accountant or IT auditor. The Dutch professional body for IT auditors, NOREA , explicitly warns that you may not present it as a quality mark or certificate. If your service is mainly IT security without any financial impact, look at SOC 2 or ISO 27001 instead.

In short: do you process salaries, administrations, pensions or transactions for other companies? Then your client’s accountant wants to know whether your processes are sound. An ISAE 3402 report answers that once for all your clients, so every accountant does not need to visit you separately.

ISAE 3402 at a glance


Full name	International Standard on Assurance Engagements 3402, Assurance Reports on Controls at a Service Organization
Issued by	IAASB, part of IFAC (December 2009)
What is it?	Assurance report on controls at a service organisation
Subject	Processes that affect your clients’ financial reporting
Types	Type 1 and type 2
Who issues it?	An accountant (NBA Standard 3402) or a registered IT auditor, RE (NOREA Guideline 3402)
Who may read it?	Your clients and their accountants
Certificate?	No, a report with an opinion
US equivalent	SOC 1

Why do clients ask for ISAE 3402?

Your client’s accountant audits the annual accounts. If part of the administration sits with you, the accountant also needs to know something about your processes. The auditing standard for outsourcing (ISA 402) sets out this requirement. An ISAE 3402 report is exactly the evidence that accountant can use.

For example: a payroll processor runs the payroll administration for 300 clients. Without a report, 300 accountants would come and ask questions or test for themselves. With one ISAE 3402 type 2 report per year, that is handled. You can read which organisations recognise this on who is ISAE 3402 for.

Everything about ISAE 3402 in one place

Below you will find the pages per question. Start with the step-by-step plan if you need to arrange a report. Start with the comparisons if you are unsure which report or certificate you need. For the parts a report must contain, see ISAE 3402 requirements.

Payroll processors, IT service providers, pension administrators and administration firms.

Who is ISAE 3402 for?

From scope to report, with an example of a control matrix.

ISAE 3402 step-by-step plan

Where the costs lie and how long a first engagement takes.

Costs and timeline

A snapshot or evidence over a period: what your client expects.

Type 1 vs type 2

Two assurance standards, and when to use which.

ISAE 3000 vs ISAE 3402

Report or certificate, and when you need both.

ISAE 3402 or ISO 27001?

Which parts the report must contain, with an example for each part.

ISAE 3402 requirements

What the auditor checks, with a checklist for preparation.

ISAE 3402 audit

Template and example of the description of your system.

System description

What a deviation in the testing section means and how to respond to it.

Deviation in type 2

Carve-out or inclusive method: which approach fits which supplier.

Subservice organisations

Which actions the client must perform itself for your report to work.

CUEC: your client's controls

Which processes the fund needs and what the accountant wants to see.

For pension administrators

ISAE 3402 and SOC 2

ISAE 3402 and SOC 2 are often confused. ISAE 3402 covers processes that affect your client’s figures. SOC 2 covers security, availability and privacy. The difference is set out on ISAE 3402 vs SOC 2.

Sources

Need help with ISAE 3402?Tell us where you are stuck. We look at your question and discuss which next step fits. Your request is free and without obligation.

Discuss your situation