ISAE 3402 audit: what the auditor checks
An ISAE 3402 audit is an assurance engagement in which a chartered accountant or registered IT auditor (RE) examines whether your description, your controls and, in a type 2, how those controls worked, are accurate. The auditor works under NOREA Richtlijn 3402 (NOREA guideline 3402) or Standaard 3402 of the NBA (NBA Standard 3402, from the Netherlands Institute of Chartered Accountants). The outcome is a report that your clients and their accountants use. The full scope of the engagement is set out in the step-by-step plan. What the report should contain is covered in the report requirements. This page is about the audit itself: what the auditor does, what they need from you, and how to prevent doubts arising.
The auditor does not check whether your company runs well. They check whether the controls you describe exist, match reality and, in a type 2, worked over the period. A good company with a poor description gets a poor report.
Three things the auditor assesses
Every ISAE 3402 audit addresses three questions. They follow the structure of the type 1 and type 2 distinction.
| Auditor’s question | Type 1 | Type 2 |
|---|---|---|
| Is the description of the system an accurate representation? | Yes, at a point in time | Yes, over the whole period |
| Are the controls designed to achieve the control objectives? | Yes | Yes |
| Did the controls actually work over the period? | Not tested | Yes, with samples |
What the auditor asks for, and why
During preparation the auditor often asks for more than you expect. Below are the documents that come up in most engagements, with the reason for each.
| Document | What the auditor does with it | Common mistake |
|---|---|---|
| Organisation chart and role descriptions | Checks who carries out which control | Roles appear in the chart but not in the description |
| Process descriptions | Walks through the process (walkthrough) to test the description | The process on paper differs from practice |
| Controls per control objective | Chooses which controls to test | Controls without a clear owner |
| Evidence of performance (logs, tickets, signatures) | Tests whether the control actually worked | Evidence exists but cannot be found or is not dated |
| List of changes in the period | Decides what needs extra testing | Changes are not recorded |
| Overview of subservice organisations | Sets the scope and method | A supplier missing from the description |
Checklist: before the auditor arrives
Use this list when you prepare the engagement. Every point should be supported by a document or a system.
- Is the scope defined and discussed with the auditor?
- Has management’s assertion been drafted, and does the board know it will sign it?
- Does the system description name every service that appears in the report, with the correct name?
- Does each control objective have at least one control and one owner?
- Is it recorded for each control which evidence you keep, where, and for how long?
- Have all changes to systems and processes in the period been logged?
- Have the subservice organisations been named, and do you have their own reports or statements?
- Does the description state which controls the client must perform themselves (see CUEC)?
- Have you held a first conversation about what the auditor will test for each area?
How the audit runs
Planning and kick-off
You and the auditor agree on scope, period, timetable and contact persons. You also record which systems and locations are included.
Walkthrough
The auditor walks through one or more processes with the people involved. They want to see that the description on paper matches what people actually do.
Testing
For a type 1, this is mainly about the design and existence of the controls. For a type 2, the auditor selects samples from the whole period and checks the evidence for each sample. This is the part that takes the most time.
Discussing findings
You discuss any deviations with the auditor before the draft is finished. You can respond with what you have done. That response may appear in the report.
Draft and final report
You receive a draft to check for factual accuracy. The board signs the assertion about the description and gives the auditor written confirmations. The final report with the opinion follows.
Common mistakes during the audit
- Starting to collect evidence too late. For a type 2, you need evidence for the whole period, not only for the end.
- Controls that exist only on paper. If the auditor sees during the walkthrough that nobody performs the control, it leads to a deviation or doubt about your design.
- Agreements made verbally. What is not fixed in a document does not count for the auditor.
- Forgetting a subservice supplier. This often leads to rework, especially if a client asks about it later. See subservice organisations.
- Waiting too long to respond to a finding. A finding you only pick up after the draft leaves you no time to write a well-supported response.
Frequently asked questions about the ISAE 3402 audit
Can the auditor also be my own adviser?
That depends on the independence rules. An adviser who set up your systems is in many cases not independent for the audit of those same systems. Ask this in advance, and record how the roles are divided.
How long does the audit itself take?
The timeline for the whole engagement is on costs and timeline. The audit itself is often only one part of it. Most of the time goes into preparing the evidence and resolving findings.
Can I choose an auditor who is not registered with NOREA or the NBA?
No. In the Netherlands, a registered accountant (RA) or a registered IT auditor (RE) issues this report. Check the auditor’s registration before you sign an engagement. For more on who may issue it, see who is ISAE 3402 for.
More information
Also read the type 1 vs type 2 overview, the system description and the page on deviations. The full overview of this section is on the ISAE 3402 start page.