ISAE 3402 for pension administrators: what your client expects from you
A pension administrator carries out work that ends up in the annual accounts of a pension fund. Examples are the administration of participants, contributions and benefits. That is why the pension fund’s accountant often asks for an ISAE 3402 report. The report shows that your processes are reliable, so the fund’s accountant can rely on them in his audit. Whether you need such a report depends on the agreements with your clients. The general framework is on who ISAE 3402 is for, and the type of report that fits is on type 1 vs type 2. The supervisor De Nederlandsche Bank (DNB, the Dutch central bank) also looks at this. Its guidance on outsourcing says that a fund must check what the scope of the administrator’s ISAE 3402 report is. At DNB, “pension administrator” sometimes refers to the fund itself. On this page, we mean the party that carries out the work for a fund.
Short answer: if the processes you carry out affect the fund’s figures, the fund’s accountant will probably ask about them. Ask in advance, because this determines the scope and the type of report.
Why pension administrators often need this report
The pension fund remains responsible for its own annual accounts, even when the work is done by you. According to DNB , outsourcing is allowed under conditions, based on article 34 of the Pensioenwet (Dutch Pensions Act). The fund also remains fully responsible for complying with the rules. The fund’s accountant therefore needs to be able to assess whether your administration is reliable. He can test this himself, but that is expensive and time-consuming. An ISAE 3402 report gives him an independent opinion he can use.
For you, this means one good report can answer many questions from different funds and their accountants. Conversely, a weak report means each fund has to test separately.
Which processes belong in the report
The scope determines what the auditor tests. For a pension administrator, this usually means processes that affect the financial data of the fund. The table below gives an indication. You record the actual scope together with your auditor and your clients.
| Process | Why it matters for the client | Typical evidence |
|---|---|---|
| Participant administration | Changes to participant data determine who receives what | Change logs, authorisations, checked changes |
| Contribution processing | Contributions must enter the administration correctly and completely | Reconciliation of receipts with bank transactions |
| Benefit payments | Outgoing payments must match the rules of the fund | Approvals, calculations, payment lists |
| Reconciliation and reporting | The fund must be able to check the figures | Reconciliation reports and the related checks |
| Access to systems | Only authorised people may change data | Access overviews, periodic reviews |
What DNB expects from the pension fund
DNB focuses on the scope of the report. Its guidance includes a test point: the fund must have a recent ISAE 3402 statement from the administrator (type 1 and 2), and all relevant processes must be in scope. The fund itself must have checked this. In 2022, DNB also wrote that assurance reports such as SOC and ISAE are often not sufficient , partly because parts of the outsourcing chain stay outside the report.
For you, this means a fund does not only ask whether you have a report, but also what it covers. An administrator that treats a supplier as a carve-out must make clear that this part of the chain falls outside the opinion. See subservice organisations.
What the fund’s accountant wants to see
The accountant wants a report that matches the processes he needs for his audit. That means three things.
- A clear scope. Which services, which period, which systems. A vague “pension administration” is not enough.
- An accurate description. How the processes run, who does what, and which systems are used. See the system description for the structure.
- Evidence of the controls. For type 2, you need evidence covering the whole period, not only the end.
Example: outsourced contribution processing
A pension administrator processes the contributions for a fund with a few thousand participants. Every month it receives a contribution overview from the employers and checks this against the bank receipts. Differences are followed up within the agreed period and reported to the fund.
If that process is in the report, the description must be precise: which overview, which reconciliation, who checks, and which tolerance applies. The evidence is the monthly reconciliations, with signature and date. If a month is missing, that is a deviation, and the fund’s accountant will see it.
The figures in this example are fictional and only show the structure. Do not use them as a standard.
Common mistakes
- Scope too broad. A report that covers “everything” is hard to read and easy to challenge. Choose the processes that affect the fund.
- Forgetting subservice organisations. An administration package, a bank or an archiving partner can be part of the chain. Decide the method per party. See subservice organisations.
- Not naming the fund’s own controls. The fund supplies data and approves some changes. This belongs in the description as CUEC.
- A report that does not match the fund’s question. Agree in advance which type and which period the fund needs.
- Requesting the report only at year end. For type 2, the period is needed before the report can be prepared, so preparation must already be running.
Agreeing the scope with the pension fund
The scope is the most important topic in preparation. A scope that is too broad makes the report heavier and easier to challenge. A scope that is too narrow leaves the fund with a gap. This order helps:
- Ask the fund for its own processes. Which work does the fund outsource, and which does it keep in-house?
- Link each process to the figures. Which process affects which item in the fund’s annual accounts? Anything that does not affect them falls outside the scope.
- Record the boundary with the client. What does the fund do itself, what do you do, and which data does the fund supply? These are the CUEC of this report.
- Determine the suppliers in the chain. A bank, an archiving party or a software supplier can be part of the process. Choose the method per party. See subservice organisations.
- Record the scope in writing. One page with processes, period and excluded parts prevents discussion after the audit.
What you see in a pension administrator’s report
A pension report usually has the same structure as any ISAE 3402 report: an opinion, a description, control objectives with controls, and tests with results. The difference is in the content. Think of:
- Objectives per process, for example “contributions are processed completely and on time”.
- Controls that match the bank transactions and the participant list, such as reconciliations and second checks.
- Evidence that is complete for each period, so the auditor can take a sample from all contribution periods.
See the system description for how to describe this, and the requirements for the report for the structure.
Frequently asked questions about ISAE 3402 for pension administrators
Is an ISAE 3402 report mandatory for pension administrators?
For you as an administrator, the report in practice appears in your contract or in your clients’ requirements. The fund is the party that must control the outsourcing, and DNB names a recent ISAE 3402 report as a point on which the fund assesses its administrator. Check your contract and ask your clients what they expect.
May a fund carry out its own audit instead of requesting a report?
It can, and sometimes it does. The disadvantage for you is that each fund then tests separately. A report prevents that, which is why it is the usual route.
How do I know which processes the fund needs?
Ask the fund’s accountant, preferably in writing. Then agree the scope with your own auditor, so that both sides have the same expectation.
What if the fund wants a different period from my financial year?
That happens. A fund with a different financial year sometimes asks for a period that does not match your report. Name that as a gap in the description, and discuss with your auditor whether the period is feasible. A report about a short period says less than a full year, and the fund needs to know that.
Can I use the same report for several funds?
Yes, provided the processes the report covers are the same for all funds. If there are differences in the agreements per fund, record them in the description or in a separate annex.
More information
Also read the step-by-step plan for the order of the process, the audit page for what the auditor does, and costs and timeline for what a first engagement costs. The overview of this section is on the ISAE 3402 start page.