ISAE 3402 step-by-step plan
You work through an ISAE 3402 engagement in seven steps: determine the scope, formulate control objectives, record controls in a control matrix, write the system description, choose an auditor, collect evidence and have the audit carried out. The core of the process is the control matrix: the table in which, for each objective, you show which controls cover the risk.
The standard itself comes from the IAASB . In the Netherlands, an accountant works under NBA Standard 3402 (the Dutch accountancy standard for ISAE 3402 engagements), and an IT auditor works under the NOREA guideline 3402 (the Dutch association of IT auditors guideline). If you are not yet sure you need ISAE 3402, read what ISAE 3402 is and who it is for first.
You write the control objectives yourself. ISAE 3402 has no fixed list of requirements, as ISO 27001 does. That gives you freedom, but the auditor critically checks whether your objectives fit what your clients expect from you.
The ISAE 3402 process in seven steps
Determine the scope
Choose which services go into the report. Think from your client’s point of view: which of your work ends up in their annual accounts? A payroll processor handles salary administration, but not an HR advisory service. Also record which systems, locations and suppliers play a role.
Formulate the control objectives
A control objective describes what must go right, in the language of the annual accounts. Think of accuracy, completeness, timeliness and authorisation. You usually have between five and fifteen. In addition, there are objectives for general IT controls, such as access management and change management.
Record the controls in a control matrix
For each objective, describe the controls that cover the risk. The example below shows what this looks like. Each control has an owner, a frequency and a form of evidence.
Write the system description
Management describes the service, the organisation, the systems, the processes and the controls. This also includes the controls your clients must carry out themselves, and how you deal with subcontractors. This description goes into the report, together with a written assertion from management.
Choose an auditor and possibly start with a type 1
Ask for quotes from two or three firms. Decide whether to start with a type 1 or go straight into a type 2 period. The difference is explained on ISAE 3402 type 1 vs type 2, and the costs on costs and timeline.
Collect evidence during the period
Carry out the controls and record each execution. Run your own check regularly, for example every quarter, so you find deviations before the auditor does.
Have the audit carried out and share the report
The auditor tests samples, discusses findings and writes the report. You share the report with your clients and their accountants. You must not publish it: it is only meant for them. What the auditor checks and which evidence you prepare is on the ISAE 3402 audit.
Example: control objective and control matrix for ISAE 3402
Suppose you are a payroll processor with 250 clients. The accountants of those clients want assurance that the payroll costs in their annual accounts are correct. One of your objectives then becomes:
Control objective 3: salary changes Controls provide reasonable assurance that changes to salary and personnel data are processed correctly, completely and on time, and only after authorisation by the client.
You work this objective out in a control matrix. Part of it looks like this:
| No. | Risk | Control | Owner | Frequency | Type | Evidence |
|---|---|---|---|---|---|---|
| 3.1 | Change made without instruction from the client | Changes are only processed after an instruction through the client portal by a user authorised by the client | Payroll administration team leader | Per change | Preventive, automated | Portal log with user and time |
| 3.2 | Input error on large amounts | Changes with an effect above €500 gross per month are checked by a second employee before payroll runs | Payroll administrator | Per change | Preventive, manual | Initials and date on the processing overview |
| 3.3 | Change processed late | Instructions that arrive after the deadline are put on an exception list that is discussed with the client | Payroll administration team leader | Per payroll period | Detective, manual | Exception list with follow-up |
| 3.4 | Difference between instruction and payroll run | After payroll, the total of the changes is reconciled to the total of the instructions | Controller | Per payroll period | Detective, manual | Signed reconciliation |
In a type 2 engagement, the auditor tests every line. For 3.2, for example, he requests the list of all changes above €500, takes a sample and checks that every one has a second set of initials.
The €500 threshold in this example is a choice, not a rule from the standard. Choose a threshold that suits your clients and explain why. The auditor will ask about it.
Which controls must your client carry out themselves?
Your controls only work if your client also does its part. In the example, the client must itself keep track of who is authorised in the portal, and check payslips on a sample basis. You name these controls in the system description. In English they are called complementary user entity controls, explained on CUEC in ISAE 3402.
If you use a supplier yourself, such as a hosting provider, you choose how it appears in the report. With the carve-out method, you leave the supplier’s controls out of the report and refer to the supplier’s own report. The difference between the two methods is explained on subservice organisations in ISAE 3402. With the inclusive method, the auditor includes them in his testing. Carve-out is the more common approach.
What the auditor wants to see in an ISAE 3402 engagement
- A system description that matches practice. The auditor walks through processes and compares them with what is written.
- A logical link. Every risk has a control, and every control belongs to an objective.
- Complete populations. Lists of all changes, modifications and new accounts in the period.
- Evidence for each execution. A log, initials or a ticket, with date and name.
- A written assertion from management. Signed by the board.
Common mistakes in the ISAE 3402 step-by-step plan
- Putting security into a 3402 report. If it does not belong to your client’s financial reporting, ISAE 3000 fits better.
- Copying objectives from another company. They must fit your service.
- Including too many controls. You must prove everything you include. Include only what is needed.
- Forgetting the client’s controls. Without that boundary, it looks as if you are responsible for the client’s errors.
- Publishing the report on your website. Use is limited to your clients and their accountants. You may say that you have a report.
Frequently asked questions about the ISAE 3402 step-by-step plan
How many control objectives does an ISAE 3402 report have?
There is no fixed number. A small payroll processor often ends up with five to ten objectives, including general IT controls. A pension administrator quickly has twenty or more. More important than the number is that each objective fits what your clients expect from you.
Which IT objectives belong in an ISAE 3402 report?
Almost every report contains objectives for general IT controls. These keep the applications you process data in reliable.
| IT objective | Example of a control |
|---|---|
| Logical access | Access rights are reviewed every quarter by the process owner |
| Change management | Changes to production are tested and approved in advance |
| Backup and recovery | Backups are made daily and recovery tests are carried out annually |
| IT operations | Faults and incidents are logged and followed up |
Must the system description be in Dutch?
You choose that yourself. If you have international clients, an English-language report is useful. Agree the language with your auditor before you start writing.
Can I use a template for the control matrix?
Yes, as a starting point. The columns in the example above are a good basis. You must write the content yourself, because the auditor compares every line with how you actually work.
More information
- ISAE 3402 type 1 vs type 2: which report your client expects
- ISAE 3402 costs and timeline: what each phase costs and how long it takes
- Collecting evidence for SOC 2: practical tips that also work for ISAE 3402
- Access rights matrix: useful for the objectives on access management