ISAE 3000 vs ISAE 3402
ISAE 3000 and ISAE 3402 are both standards for assurance reports, but they cover different subjects. ISAE 3402 is specific to reports on controls at a service provider that affect its clients’ financial reporting. ISAE 3000 is the general standard for all other assurance, for example on information security, privacy or availability.
Both come from the IAASB. The revised ISAE 3000 applies to reports from 15 December 2015. ISAE 3402 has been in force since 2011. A SOC 2 report is usually performed under ISAE 3000 in the Netherlands.
Short answer: if your service affects your client’s figures, it is ISAE 3402. If it concerns something else, such as security or privacy, it is ISAE 3000. An ISAE 3402 report may not simply cover security.
ISAE 3000 and ISAE 3402 side by side
| ISAE 3402 | ISAE 3000 | |
|---|---|---|
| Full name | Assurance Reports on Controls at a Service Organization | Assurance Engagements Other than Audits or Reviews of Historical Financial Information |
| Type of standard | Specific | General, the umbrella for other assurance |
| Subject | Processes that affect clients’ financial reporting | Any other subject: security, privacy, availability, legislation, sustainability |
| Reader | Clients and their accountants | Depends on the engagement, often clients, procurement and regulators |
| Criteria framework | Your own control objectives | Varies: Trust Services Criteria, BIO, DigiD criteria framework, own criteria |
| Best-known use | Report for payroll processors and administrators | SOC 2, DigiD audits, privacy assurance |
| Dutch implementation | NBA Standard 3402, NOREA Guideline 3402 | NBA Standard 3000A and 3000D, NOREA Guideline 3000 |
| US equivalent | SOC 1 | SOC 2 (via the AICPA) |
What does ISAE 3402 cover?
ISAE 3402 has a narrow and clear subject. According to the IAASB summary , the standard is intended for services that are relevant to clients’ internal control, insofar as they affect financial reporting. Reports on, for example, production or quality control at clients fall explicitly outside it.
For example: an administration firm processes the purchase invoices of 80 small and medium-sized clients. Errors in that processing flow directly into the annual accounts. That is a typical ISAE 3402 subject.
What does ISAE 3000 cover?
ISAE 3000 is broad. The standard sets out how an auditor provides assurance on any subject that is not historical financial information. You choose the criteria framework for each engagement.
For example: a hosting company wants to show its clients that its servers are well secured and remain available. This does not affect those clients’ annual accounts. The report then becomes an ISAE 3000 report, often in the form of a SOC 2. The DigiD audit that municipalities have carried out each year also runs under the 3000 standard. You can read about this on ENSIA and ISO 27001 for municipalities.
What is the difference between 3000A and 3000D?
In the Netherlands, the NBA has developed ISAE 3000 in two variants. The difference lies in who makes the assertion.
| Variant | How it works | Example of the outcome |
|---|---|---|
| 3000A (attestation) | Management makes an assertion, and the auditor tests it | ”Management’s assertion that the controls work is correct” |
| 3000D (direct) | The auditor measures against the criteria directly, without an assertion from management | ”The controls comply, in all material respects, with the criteria framework” |
ISAE 3402 always works with a management assertion, as does 3000A. For ENSIA, municipalities have moved to 3000D for DigiD and Suwinet (the Dutch government information exchange network).
Can you combine ISAE 3402 and ISAE 3000?
Yes, and many service providers do. A payroll processor with its own online portal has two kinds of client questions. The accountant wants to know whether the payroll is correct (ISAE 3402). The client’s IT department wants to know whether the portal is secure (ISAE 3000 or SOC 2).
You can then have two reports produced in one engagement. The auditor tests the general IT controls, such as access management, change management and backups, once and uses them in both reports.
Security and availability do not fit in an ISAE 3402 report if they have no link to financial reporting. NOREA warns that such reports then go beyond the boundaries of 3402, and refers to Guideline 3000.
What the auditor wants to see for ISAE 3000 and 3402
Preparation looks very similar in both cases. In either case, you need to be able to show:
- a description of your service and systems, within a clear scope;
- a criteria framework: your own control objectives for 3402, or an existing framework such as the Trust Services Criteria for 3000;
- controls with an owner, linked to that framework;
- evidence of performance, if it is a type 2 report.
For how to build this step by step, see the ISAE 3402 step-by-step plan.
Common mistakes when choosing between ISAE 3000 and 3402
- Asking for “ISAE 3402 for security”. This often appears in tenders. Ask what the client actually wants to know. If the concern is security, ISAE 3000 or SOC 2 fits better.
- Thinking one replaces the other. Your client’s accountant does not accept a security report as evidence for their annual accounts audit.
- Wanting everything in one report. Two reports from one engagement are often clearer for both readers.
Frequently asked questions about ISAE 3000 and ISAE 3402
Is a SOC 2 report an ISAE 3000 report?
In the Netherlands, usually yes. SOC 2 is an American report format with the Trust Services Criteria as its criteria framework. A Dutch IT auditor performs the engagement under ISAE 3000, so that the report meets both frameworks. Read more on SOC 2 in the Netherlands.
Who may issue an ISAE 3000 or ISAE 3402 report?
In the Netherlands, a chartered accountant who works under the NBA standards, or a registered IT auditor (RE) who works under the NOREA guidelines. A certification body that issues ISO certificates cannot do this without such a professional. For the ENSIA audit on DigiD and Suwinet, a registered IT auditor with NOREA is mandatory.
Is there also a type 1 and type 2 under ISAE 3000?
ISAE 3000 does not use those terms itself, but engagements on controls are often set up in the same way. A SOC 2 report under ISAE 3000, for example, also has a type I and a type II. Under ISAE 3402, the two types are part of the standard itself. See ISAE 3402 type 1 vs type 2.
Can I make an ISAE 3000 report public?
That depends on the terms of the engagement. An ISAE 3402 report is always only for clients and their accountants. For ISAE 3000, the engagement decides who may read it. If you want to share something publicly, ask for a shorter report format, such as a SOC 3 alongside a SOC 2.
More information
- What is ISAE 3402?: the basics
- ISAE 3402 vs SOC 2: the financial and the security variant side by side
- SOC 2 in the Netherlands: how ISAE 3000 and NOREA work together
- ISAE 3402 or ISO 27001?: report or certificate
- NOREA: regulations and guidelines : Guideline 3000 and Guideline 3402