ISAE 3402 costs and timeline
The cost of ISAE 3402 consists of three parts: preparation, the audit by an accountant or IT auditor, and the time of your own staff. For a medium-sized service provider, a type 2 audit indicatively costs between €20,000 and €60,000 per year. From the first conversation to the first type 2 report, you are usually 12 to 18 months away, mainly because the auditor needs to be able to test a period of 6 to 12 months.
There are no fixed rates. Each firm charges on the basis of hours, and the number of hours depends on your scope. The rules on who may issue the report are set by the NBA for accountants and by NOREA for IT auditors. For what ISAE 3402 actually is, read what is ISAE 3402.
The amounts on this page are indications. They are in line with the range we quote for SOC 1, the US equivalent. Always request two or three quotes based on the same scope description.
Which cost items make up ISAE 3402?
| Cost item | What you get | Indication |
|---|---|---|
| Readiness assessment (optional) | A baseline measurement of your processes and controls, with points for improvement | Depends on scope, usually a fraction of the audit costs |
| Advice on set-up (optional) | Help with the system description, control matrix and evidence | Hourly, strongly dependent on what you do yourself |
| Type 1 audit | Opinion on the description and design at one date | Clearly lower than a type 2 |
| Type 2 audit | Opinion on design and operating effectiveness over 6 to 12 months | Indication €20,000 to €60,000 per year |
| Internal time | Process descriptions, gathering evidence, conversations with the auditor | Often the largest hidden cost in year one |
| Tooling (optional) | A GRC tool to keep track of controls and evidence | Subscription, not mandatory |
The adviser who helps you set up the system may not be the same party that issues the report. An auditor who assesses their own work is not independent. If you want to know what a readiness assessment involves, see the SOC 2 readiness assessment. The approach is similar.
What sets the price of an ISAE 3402 audit?
The number of auditor hours sets the price. Those hours depend mainly on five factors.
| Factor | Lower cost | Higher cost |
|---|---|---|
| Number of control objectives | 5 to 8 objectives | 15 or more |
| Number of controls | Around 30 | 80 or more |
| Number of locations and systems | One office, one application | Several branches, own and purchased systems |
| Outsourcing to third parties | Few, or suppliers with their own report | Suppliers without a report that you must include |
| Maturity | Processes already documented, evidence automatic | Much manual work, evidence on paper or in mailboxes |
For example. A payroll processor with one payroll package, two hosting suppliers that each have their own ISAE 3402 report and six control objectives sits at the lower end of the range. A pension administrator with its own software, three locations and twenty objectives sits at the upper end or above it.
How long does an ISAE 3402 engagement take?
The timeline depends mainly on the testing period. A type 2 report can only be issued once that period has ended. The timeline below is an indication for a first engagement.
| Phase | What happens | Indicative duration |
|---|---|---|
| 1. Scope and baseline | Define services, clients and processes, map gaps | 1 to 2 months |
| 2. Set-up | Draft the system description and control matrix, introduce missing controls | 2 to 6 months |
| 3. Type 1 audit (optional) | Auditor tests description and design at one date | 1 to 2 months |
| 4. Type 2 testing period | Controls run and you record the evidence | 6 to 12 months |
| 5. Type 2 audit and report | Auditor tests samples and writes the report | 1 to 3 months after the period |
After that, it becomes an annual cycle. The report for financial year 2026, for example, would then be issued in the first quarter of 2027, in time for your clients’ annual audits. For how to approach each phase, see the ISAE 3402 step-by-step plan.
Can you get ISAE 3402 faster?
Somewhat. You cannot skip the testing period, but you can choose it wisely.
- Start with type 1. Within a few months you have a report to show clients. You can read the difference on ISAE 3402 type 1 vs type 2.
- Choose a shorter first period. Six months instead of twelve, after which you align with the financial year.
- Collect evidence from day one. Whoever has to search for it halfway through loses months.
What the auditor wants to see before making a quote
A good quote starts with a good scope description. Send every firm the same information, so you can compare the quotes.
- Which services fall under the report, and for how many clients.
- Which systems and locations you use.
- Which suppliers play a role, and whether they have their own report.
- Whether you want a type 1, a type 2 or both, and which period.
- Whether you also want a report on security, such as an ISAE 3000 or SOC 2 report.
Common mistakes when budgeting for ISAE 3402
- Budgeting only the audit invoice. Internal time in year one is often at least as large.
- Too broad a scope. Each extra service means extra controls and extra testing work.
- Not allowing for annual costs. A type 2 is not a one-off expense. Your clients want a new report every year.
- Comparing quotes with different scopes. A low price sometimes simply means less testing work.
Frequently asked questions about ISAE 3402 costs
Is a follow-up report cheaper than the first ISAE 3402 report?
Usually, yes. In the first year you pay for getting to know your organisation, walking through all processes and often a type 1. In later years, the auditor already knows your description and focuses on the testing work. Your internal time also falls, because the evidence becomes routine.
Is ISAE 3402 more expensive than ISO 27001?
Not necessarily, but the cost pattern is different. An ISO 27001 certificate runs on a three-year cycle with lighter surveillance audits in between. An ISAE 3402 type 2 requires a full report with testing per control every year. Over three years, ISAE 3402 is therefore often higher.
Can you share costs if you also have SOC 2 or ISAE 3000 done?
Partly. The auditor tests the general IT controls once and uses them in both reports. A combined engagement is therefore cheaper than two separate engagements, but more expensive than a single report.
May my adviser also do the audit?
No. The party that helps you set up the system may not issue the report. This is a matter of independence. You can, however, combine an adviser and an auditor from different firms.
More information
- What is ISAE 3402?: the basics
- ISAE 3402 step-by-step plan: the phases in detail
- SOC 2 costs and timeline: for comparison
- Who is ISAE 3402 for?: which service providers are asked for it