ISAE 3402 or ISO 27001?
ISAE 3402 and ISO 27001 answer different questions. ISAE 3402 is an assurance report in which an accountant or IT auditor assesses whether your processes do not endanger your clients’ annual accounts. ISO 27001 is a certificate that shows your information security is in order as a management system. If your service affects your clients’ figures, their accountant asks for ISAE 3402. If it concerns the safety of their data, their procurement or IT department usually asks for ISO 27001.
ISO 27001 is a standard from ISO , and ISAE 3402 is a standard from the IAASB . They do not exclude each other. Many payroll processors and IT service providers have both.
Short answer: your client’s accountant cannot do anything with an ISO 27001 certificate for their annual audit. And a buyer who requires ISO 27001 usually does not accept an ISAE 3402 report. So first ask who will read the evidence.
ISAE 3402 and ISO 27001 side by side
| ISAE 3402 | ISO 27001 | |
|---|---|---|
| What do you get? | Assurance report with an opinion | Certificate |
| Subject | Processes that affect clients’ financial reporting | Information security: confidentiality, integrity and availability |
| Criteria framework | Your own control objectives | Fixed requirements in clauses 4 to 10, plus Annex A |
| Who checks? | Accountant (NBA) or registered IT auditor (NOREA) | Certification body, accredited by the RvA (Dutch Accreditation Council) |
| Validity | Report on one date or one period, renewed every year | Certificate valid for three years, with annual surveillance audits |
| Detail for the reader | High: for each control, it states what was tested and the result | Low: the certificate states the scope and standard |
| Public? | No, only for clients and their accountants | Yes, you may publish the certificate |
| Who asks for it? | Clients’ accountants, pension funds, financial institutions | Procurement, IT departments, government, tenders |
When do you choose ISAE 3402?
Choose ISAE 3402 if your work ends up directly in your client’s bookkeeping. Think of payroll, invoicing, investment administration, pension administration or processing payments.
For example: an administration firm books the invoices and payments of 60 clients. The accountants of those clients need to be able to rely on the firm’s work. An ISO 27001 certificate tells them nothing about whether the entries are correct. An ISAE 3402 type 2 report does. You can read which service providers often find themselves in this situation on who is ISAE 3402 for.
When do you choose ISO 27001?
Choose ISO 27001 if your clients mainly want to know whether their data is safe. This applies to software companies, hosting parties, managed service providers and many business service providers.
For example: a software company supplies a planning tool to care institutions. The tool does not affect those institutions’ annual accounts. Their buyers and their data protection officer do want to know whether the security is sound. You answer that with ISO 27001. See also ISO 27001 for SaaS companies.
When do you need both ISAE 3402 and ISO 27001?
When your service affects both the figures and sensitive data. A payroll processor is the textbook case. Your client’s accountant wants assurance over payroll costs. The HR department and the privacy officer want to know whether the personal data of all employees is well protected.
| Service provider | ISAE 3402 | ISO 27001 |
|---|---|---|
| Payroll processor | Yes, for payroll costs | Often, for personal data |
| Administration firm | Yes, if clients have an accountant’s audit | Sometimes, at clients’ request |
| Pension administrator | Yes, pension funds ask for it | Often, for member data |
| SaaS without a financial function | No | Yes |
| Hosting provider for financial systems | Sometimes, as part of the chain | Yes |
Can you reuse ISO 27001 for ISAE 3402?
Partly. Every ISAE 3402 report contains general IT controls: access management, change management, backups and management of the IT environment. If you already have a working ISO 27001 ISMS, you have usually set these up and documented them.
What you cannot reuse are the process controls. A second check on payroll changes, or a reconciliation between assignments and payroll, does not appear anywhere in ISO 27001. You build those separately, as described in the ISAE 3402 step-by-step plan.
An ISO 27001 certificate does not test the operation of each control the way a type 2 report does. The certification body checks the management system using samples. Your client’s accountant therefore cannot rely on the certificate in the same way.
What the auditor wants to see for ISAE 3402 and ISO 27001
The two auditors look at the same evidence in different ways.
- ISO 27001 auditor: does your ISMS work? Do you have a risk assessment, a statement of applicability, internal audits and a management review?
- ISAE 3402 auditor: is your system description accurate, and did each control work during the period? They want populations and samples per control.
Common mistakes when choosing between ISAE 3402 and ISO 27001
- Offering one as a replacement for the other. Ask your client who reads the evidence and what for.
- Calling ISAE 3402 a certificate. NOREA explicitly warns against this.
- Setting up ISO 27001 for the IT department only. For a payroll processor, the processing activities also belong in the scope of your security.
Frequently asked questions about ISAE 3402 and ISO 27001
What should I do first, ISAE 3402 or ISO 27001?
Start with what your clients ask for most often. If the request comes from clients’ accountants, start with ISAE 3402. If it comes from procurement or tenders, start with ISO 27001. If you need both, an ISMS is a good foundation: your general IT controls are then already in place when you start on ISAE 3402.
Can the same party do both ISAE 3402 and ISO 27001?
Not always. An ISO 27001 certificate comes from a certification body. An ISAE 3402 report comes from an accountant or registered IT auditor. Some organisations have both in-house, but they remain two separate engagements with their own rules.
Does ISAE 3402 count towards NIS2?
Not automatically. NIS2, implemented in the Netherlands through the Cyberbeveiligingswet (Dutch Cybersecurity Act), requires appropriate security measures and a duty of care across the supply chain. An ISAE 3402 report concerns financial processes and covers that only in part. An ISO 27001 ISMS fits better, see NIS2 and ISO 27001.
Do American clients accept ISAE 3402?
Often yes, because ISAE 3402 and SOC 1 answer the same question in substance. Some clients specifically ask for a SOC 1. Many audit firms can produce one report that meets both standards.
More information
- What is ISAE 3402?: the basics
- What is ISO 27001?: the standard for information security
- ISAE 3402 vs SOC 2: the financial variant alongside the security report
- ISO 27001 vs SOC 2: certificate alongside report
- ISO 27001 costs and timeline: what a certificate costs