Who is ISAE 3402 for?
ISAE 3402 is meant for service providers whose work flows directly into their clients’ annual accounts. The best-known examples are payroll processors, IT service providers that manage financial systems, pension administrators and bookkeeping firms. Their clients have an accountant, and that accountant must be able to rely on the outsourced work.
The standard describes these as service providers that are “relevant to the internal control of clients, insofar as it affects financial reporting”. That wording is in the summary by the IAASB . You can read what the report itself is on what ISAE 3402 is. If your work is mainly about security, look at who SOC 2 is for instead.
A quick test: if you make a mistake, does a wrong amount end up in your client’s annual accounts? If yes, ISAE 3402 is probably relevant. If not, you are more likely to look at ISO 27001 or SOC 2.
Who is ISAE 3402 for: overview per type of service provider
| Service provider | What they do for clients | Why the client’s accountant looks at it | Who asks for it |
|---|---|---|---|
| Payroll processor | Payroll administration, wage tax returns, payments | Payroll costs and wage taxes in the annual accounts | Clients’ accountants, larger employers |
| IT service provider | Hosting and management of financial applications | The reliability of bookkeeping and ERP systems | Clients with a statutory audit obligation, financial institutions |
| Pension administrator | Pension administration, premium collection, benefit payments | Pension obligations, premiums and benefits | Pension funds and their accountants |
| Bookkeeping firm | Bookkeeping, debtors and creditors | Revenue, costs, receivables and debts | Clients’ accountants |
| Asset manager or fund administrator | Investment administration, valuation | Investments and results | Funds, institutional investors |
| Payment service provider | Processing of payments and direct debits | Revenue and cash flows | Webshops, clients’ accountants |
Payroll processors and payroll software
Payroll processing is the textbook example of ISAE 3402. An error in payroll leads directly to incorrect payroll costs and wage taxes for the client. Large software providers and payroll bureaus therefore publish a type 2 report for their clients every year.
At a payroll bureau, the report focuses on changes, calculations, returns and payments. A worked example of such a control objective with a control matrix is in the ISAE 3402 step-by-step plan.
IT service providers
An IT service provider does not affect the client’s annual accounts directly, but it does so through the systems. If a client’s bookkeeping system runs with you, the accountant wants to know whether anyone can change data without authorisation, and whether backups work.
The report then covers general IT controls: access management, change management, backup and recovery, and infrastructure management. Note the boundary. If clients also want to know whether their data stays confidential, that is a security question. An ISAE 3000 or SOC 2 report fits better there.
Pension administrators
Many pension funds outsource their administration to a pension administrator. The fund remains responsible for the outsourced work and must show that it controls it. Funds and their accountants therefore almost always ask for an ISAE 3402 type 2 report from the administrator.
The report then covers processes such as processing employment records, premium collection, pension accrual and benefits. Such reports are often large, with dozens of control objectives. You work out which processes your client needs, and what the accountant wants to see, on ISAE 3402 for pension administrators.
Bookkeeping firms
A bookkeeping firm that keeps clients’ books falls under ISAE 3402 if those clients have a statutory audit. For a sole trader without an audit obligation, a report is usually too heavy. For a firm that handles the financial administration of medium-sized companies, foundations or care institutions, the request is becoming more common.
For example, a firm processes the accounts payable of 40 care providers. The accountants of those care providers want assurance that all invoices are complete and correct, and that they were only paid after approval. One ISAE 3402 report saves the firm 40 separate audits a year.
When do you not need ISAE 3402?
- Your service does not affect the annual accounts. A marketing agency or a developer of a planning tool gets nothing from it.
- Your clients have no statutory audit. Then nobody uses the report.
- Your client actually asks for security. Then ISO 27001 or SOC 2 fits better. The difference is explained on ISAE 3402 or ISO 27001.
What the auditor wants to see at a first meeting
An auditor first asks who your clients are and what you do for them. That determines whether ISAE 3402 is the right standard. Make sure you can show:
- which services you provide, and to how many clients;
- which steps of your process end up in the bookkeeping of the client;
- which systems you use for that;
- which clients or accountants have already asked for a report.
Common mistakes when asking whether ISAE 3402 is needed
- Starting a report based on one client request. Check whether more clients ask for it, and which type they want.
- Taking the scope too broad. Include only the services that affect the annual accounts.
- Not knowing the difference with SOC 1. American clients ask for SOC 1. In substance it is the same question, and many firms can combine both in one report.
Frequently asked questions about who ISAE 3402 is for
Is ISAE 3402 mandatory?
In general, ISAE 3402 is not a legal obligation. The obligation arises through your clients. Their accountant needs assurance about outsourced work, and they put that question to you. Contracts and tenders therefore often state it as a hard requirement.
Do I need ISAE 3402 as a small payroll processor?
That depends on your clients. If you mainly serve small business owners without an audit obligation, nobody is likely to ask for it. If you work for medium-sized employers with a statutory audit, you will get the question sooner or later. Then start with a type 1 and a limited scope.
Must my own supplier also have a report?
If that supplier plays a role in your process, your auditor wants to know how you control it. The easiest route is for the supplier to have its own ISAE 3402 or ISAE 3000 report. Your report then refers to it under the carve-out method, explained in the step-by-step plan.
How do I know which type my client wants?
Ask, and check the contract. In practice, clients almost always mean type 2. The difference is explained on ISAE 3402 type 1 vs type 2.
More information
- What is ISAE 3402?: the basics
- ISAE 3402 costs and timeline: what an engagement requires
- ISAE 3402 type 1 vs type 2: which report your client expects
- SOC 2 vs SOC 1: the American reports side by side