ISAE 3402 type 1 vs type 2
An ISAE 3402 type 1 report assesses whether your controls are properly described and well designed on one date. An ISAE 3402 type 2 report does the same, and also tests whether those controls actually operated for a whole period. Accountants of your clients almost always want type 2, because they must rely on what happened over the full financial year.
The two types are set out in the standard itself. See the summary of ISAE 3402 by the IAASB . If you are new to this topic, read what ISAE 3402 is first. If you work with security reports, you may already know the same distinction from SOC 2 type I and type II.
Short answer: type 1 is a snapshot, type 2 is a film. The snapshot shows that your controls are in place. The film shows that you also carried them out for six to twelve months.
ISAE 3402 type 1 and type 2 side by side
The table sets out the differences. The opinions per type come from the standard. The period and duration are what you see in practice.
| Type 1 | Type 2 | |
|---|---|---|
| Question | Are the controls well described and well designed? | The same, and have they operated for the whole period? |
| Time frame | One date, for example 30 June | A period, for example 1 January to 31 December |
| Auditor’s testing | Walking through processes (walkthrough), reading documents | Also samples across the whole period |
| What your client can do with it | Understand your processes | Rely on your processes in the annual audit of its accounts |
| Period in practice | None | Usually 6 to 12 months, often the same as the financial year |
| Usual when | First report, or a new service | Annual follow-up report |
What does the auditor test with type 1?
With type 1, the auditor gives an opinion on two things. Does your system description match how things are actually set up? And are the controls suitable for achieving your control objectives?
An example for a payroll processor. The objective is “changes to salary data are processed correctly and completely”. The control is that a second employee checks every change above €500 before payroll. The auditor checks whether that control exists, whether it is documented, and whether it logically covers the risk. He does not check whether it also happened every month.
What does the auditor test with type 2?
With type 2, the opinion on operation is added. The auditor takes samples from the whole period. For the payroll processor, for example, he requests 25 changes above €500, spread across the year, and checks whether the second check can be shown for each change.
The report then shows, per control, what the auditor tested and what the result was. A deviation that is found is called an exception. One exception does not have to be a problem, as long as you can show that you noticed it and resolved it.
A type 2 report without exceptions is not the goal. The goal is an honest picture. An auditor who never finds anything raises more questions with your client’s accountant than a report with two well-explained exceptions.
Which one should you choose: ISAE 3402 type 1 or type 2?
Look at who reads the report. Your client’s accountant audits a full financial year. A snapshot helps him only to a limited extent, so he asks for type 2. You also see this in contracts and tenders, which usually say “ISAE 3402 type II”.
Type 1 has its place too. Use it if you have never had a report before, or if you are launching a new service. You then quickly show that the design is right, and you learn how the auditor works. Half a year to a year later, the first type 2 follows.
| Situation | Advice |
|---|---|
| Client asks for ISAE 3402 without naming a type | Ask. They almost always mean type 2 |
| First report, client wants to see something quickly | Type 1, followed by type 2 |
| Processes have been stable for years | Go straight to type 2, possibly with a shorter first period |
| You already have a type 2 | A new type 2 each year that follows on from the previous one |
How long the whole process takes and what it costs is on ISAE 3402 costs and timeline.
How long is the period of an ISAE 3402 type 2?
The standard does not prescribe a fixed minimum period. In practice, you see 6 to 12 months. A first type 2 report often covers a shorter period, so that you do not have to wait a full year. After that, you usually align with your clients’ financial year.
That alignment matters. If your report period runs from 1 July to 30 June, the accountant of a client with a calendar year is missing half a year. Bridge that gap with a bridge letter: a statement from your own management that nothing material has changed since the end of the period. You can read how this works on bridge letter.
What does the auditor want to see for a type 2?
For a type 2, you need evidence for the whole period, not only for today. Collect this from the first day.
- Recorded execution. An initial, a ticket or a log for each control.
- Complete populations. A list of all changes, modifications or new users in the period, so the auditor can take a sample from it.
- Deviations with follow-up. What went wrong, who resolved it and when. For how to read and respond to a deviation, see deviation in a type 2 report.
- Changes to processes. If a control changed halfway through, that must be in the description.
Common mistakes with ISAE 3402 type 1 and type 2
- Presenting type 1 as the end point. Clients’ accountants usually do not accept it as a basis for their audit.
- Including too many controls. Every control in a type 2 is tested. Include only what is needed to achieve the objectives.
- Looking for evidence only after the period. What was not recorded cannot be tested by the auditor. That becomes an exception.
- No alignment with the financial year. Your client then has a gap that you must close with extra statements.
Frequently asked questions about ISAE 3402 type 1 and type 2
What is in an ISAE 3402 type 2 report?
A type 2 report usually has five components. With type 1, the testing over a period is missing.
| Component | Who writes it | What it contains |
|---|---|---|
| Assurance report | Auditor | The opinion on the description, design and (for type 2) operation |
| Management’s assertion | Management | The statement that the description and controls are accurate |
| System description | Management | Service, organisation, systems, processes and user controls |
| Objectives, controls and test results | Auditor and management | Per control: what was tested, how, and with what result |
| Other information (optional) | Management | For example, a response to the exceptions found |
How long is an ISAE 3402 type 2 report valid?
A report has no period of validity, like a certificate. It covers a closed period. Your clients and their accountants do expect a new report every year that follows on from the previous one, so that no gaps arise.
What happens if the auditor finds exceptions?
The auditor names every exception in the report. If they are limited and well followed up, the opinion usually remains unqualified. If they are so serious that a control objective was not met, the auditor may issue a qualified opinion. Therefore discuss findings early, so that you can explain them in the report.
Is ISAE 3402 type 2 the same as SOC 1 type 2?
In substance, yes: both cover controls that affect clients’ financial reporting. The difference is the standard. SOC 1 follows the American rules of the AICPA, and ISAE 3402 follows the international rules of the IAASB. Many firms can produce a report that meets both. You can read more about this on SOC 2 vs SOC 1.
More information
- What is ISAE 3402?: the basics
- ISAE 3402 step-by-step plan: from scope to report, with a control matrix
- SOC 2 type I vs type II: the same distinction for SOC 2
- SOC 2 vs SOC 1: the American counterpart of ISAE 3402