ISAE 3402 requirements: what must the report contain?
An ISAE 3402 report consists of four things: the auditor’s opinion, a statement from your management, a description of your system with its control objectives and controls, and (in a type 2) the tests the auditor carried out with their results. This follows from the international standard of the IAASB , the international standard setter for assurance. In the Netherlands, the auditor works with Standaard 3402 (NBA Standard 3402, from the Netherlands Institute of Chartered Accountants) for accountants, or Richtlijn 3402 (NOREA guideline 3402) for IT auditors. What you need to arrange yourself to complete these parts is set out in the step-by-step plan.
ISAE 3402 does not have a list of requirements that you “meet” in the way a certification standard does. The report must still contain the right parts, and the auditor decides whether your description and controls are credible. A report with no deviations is therefore not the same as a report you have “passed”.
The parts of an ISAE 3402 report
The table lists the parts. Note the column “who writes it”: part of the report is yours, and part is the auditor’s. The structure matches the table on type 1 vs type 2.
| Part | What it contains | Who writes it | What your client looks for |
|---|---|---|---|
| 1. Auditor’s opinion | Conclusion on the description, the design (type 1) and the operating effectiveness over a period (type 2) | Auditor | Is the opinion unqualified? |
| 2. Management’s assertion | Statement by the board that the description is accurate and the controls are suitably designed (and, in a type 2, operated effectively) | Management | Has the board signed it? |
| 3. System description | Services, processes, infrastructure, staff, data, plus the control objectives and controls | You | Does it match what the client actually uses? |
| 4. Tests and results (type 2) | What the auditor did and what they found | Auditor | Are there deviations? |
| 5. Other information (optional) | For example your response to a deviation | You | Has it been resolved, and when? |
Requirement 1: the auditor’s opinion
The opinion is the page most readers open first, and the last they read. For a type 1, it addresses two questions: is the description an accurate representation of your system, and are the controls designed to achieve the control objectives? For a type 2, a third question is added: did the controls operate effectively over the whole period? The difference between the two types is explained on type 1 vs type 2.
For you, this means the auditor judges what you have described. A vague description can lead to an opinion with a qualification, even if your processes are good.
Requirement 2: a management assertion
Management states in writing that the description is an accurate representation and that the controls are suitably designed. In a type 2, it also states that the controls operated effectively over the period. The auditor gives their opinion on those same points. In this way, responsibility for the content lies with you, and the assessment lies with the auditor. The standard requires this part: a service organisation that will not give a written assertion cannot receive an ISAE 3402 report. You do not need to carry out a separate check for it. The assertion may rely on oversight that is already part of your work, such as periodic reviews by managers and internal audits.
In practice: the director of a payroll processor signs a page stating that the description matches how the work was carried out during the year. That page sits in front of the testing section of the report.
Requirement 3: a description that matches practice
The system description is the part of the report you write most yourself. It must be concrete enough for your client’s accountant to understand which data reaches you and what you do with it. What a good description contains, and a workable template, is set out in the ISAE 3402 system description.
A description that looks good but is not accurate is one of the biggest risks. The auditor compares the text with what they see in practice.
Requirement 4: control objectives and controls
A control objective describes what you want to guarantee. A control describes how you do it. The report must link the two, so the reader sees why a control exists.
An example at a payroll processor. It is fictional but realistic in its design:
| Control objective | Control | Evidence the auditor looks for |
|---|---|---|
| Changes to payroll data are authorised | A second employee approves changes above €500 before they are processed | Approval in the workflow tool, with name and date |
| Only authorised people have access to the payroll package | The team leader reviews the user list every quarter and adjusts rights | Signed review with the changes |
| Changes to the package are tested before production | Changes go first to a test environment | Change ticket with test result and approval |
Look at the evidence column. A control without evidence is almost impossible to test in a type 2 report. That is also why the costs and timeline of a first engagement often lie more in building evidence than in the audit itself.
Requirement 5: tests and results
The report describes the tests the auditor carried out. For a type 1, the focus is mainly on design: does the auditor walk through the process and read the documents? For a type 2, sample testing over the period is added. The number and spread of those samples are determined by the auditor, not by you. You can make sure the evidence is complete and easy to find.
The report must also show the results. A test without a finding is “no deviation”. A finding that shows a control did not work is a deviation. For how to read one and what to do about it, see deviation in a type 2 report.
Requirement 6: what the report is not
The report is not a certificate or a quality mark. It describes a situation at a date or over a period, and it is intended for your clients and their accountants. This has two practical consequences:
- Do not present the report as “ISAE 3402 certified”. NOREA describes this in an audit alert as a misrepresentation. You may say that a report is available for clients and their accountants.
- A client can ask for additional explanation, but cannot ask for a different opinion. The auditor decides that.
Common mistakes with the requirements
- The description reads like a brochure. Marketing text about your service does not belong in the description. The auditor wants to see the actual processes.
- Controls without an owner. If it is unclear who performs a control, there is nothing to test.
- Control objectives that say nothing about the client’s risk. “We keep the system up to date” is not an objective that helps an accountant.
- Hiding deviations in the description. A deviation belongs in the testing section. A description that suggests the control always worked will be quickly exposed when the testing section is read.
- Describing only today’s service. If you changed something during the period, it must appear in the report.
Frequently asked questions about ISAE 3402 requirements
May I choose the control objectives myself?
Yes, within the scope you agree with the auditor. The auditor checks whether the objectives are relevant to your clients’ financial reporting. An objective you leave out because it is difficult will quickly stand out if the risk is there.
My client wants a specific requirement in the report. Is that possible?
An ISAE 3402 report does not answer every client-specific checklist. You can, however, agree with your auditor whether a topic fits within the scope. Ask this in advance, not after the draft.
What requirements apply to the auditor?
They must be independent and hold the right registration: a registered accountant (RA) who applies Standaard 3402 of the NBA, or a registered IT auditor (RE) who applies the NOREA guideline. For the difference between the two and how to choose, see who is ISAE 3402 for.
Do I need to have the standard myself?
It is not necessary. Your auditor works with the standard and explains what they need from you. If you want to read along, Richtlijn 3402 is on the NOREA website.