ISAE 3402 vs SOC 2: what is the difference?
ISAE 3402 and SOC 2 are both assurance reports, but they answer a different question. ISAE 3402 shows that your controls do not put your customer’s financial reporting at risk. SOC 2 shows that your IT security is in order. ISAE 3402 is a standard from the IAASB (International Auditing and Assurance Standards Board) , while SOC 2 comes from the American AICPA (American Institute of CPAs) . Which one you need depends on what your customers outsource to you.
The short answer: if you process something that affects your customer’s numbers (payroll, invoicing, transactions), their accountants want ISAE 3402. If you mainly host or process data, their security teams want SOC 2. ISAE 3402 is in effect the international counterpart of SOC 1.
ISAE 3402 belongs to SOC 1 (financial reporting). SOC 2 runs on the broader ISAE 3000 standard (security and trust). So do not confuse 3402 with 3000.
What is ISAE 3402?
ISAE 3402 stands for International Standard on Assurance Engagements 3402. The standard tests controls at a service provider that affect the “internal control over financial reporting” (ICFR) of its customers. In other words: does what you do affect your customer’s annual accounts?
Example: you process salary payments for hundreds of companies. If you make an error, the wrong payroll costs end up in their profit and loss accounts. Your customer’s accountant then wants assurance about your process. You provide that assurance with an ISAE 3402 report.
The American version is called SOC 1. In substance they cover the same ground, only the standard differs by region. You can read who issues the report, what it contains and how to approach it on what is ISAE 3402.
What is SOC 2?
SOC 2 tests your security against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. The question is not “do the numbers add up?” but “is the data safe and the system reliable?”
Example: you offer a SaaS platform where customers store their client data. They want to know that nobody else can access that data, that your system stays available, and that you can prevent a data breach. You provide that evidence with a SOC 2 report.
In Europe, accountants often perform SOC 2 under ISAE 3000, the general assurance standard for non-financial engagements. Read more about SOC 2 in the Dutch context.
ISAE 3402 vs SOC 2: the differences at a glance
| Aspect | ISAE 3402 | SOC 2 |
|---|---|---|
| Subject | Financial reporting (ICFR) | IT security and trust |
| Question it answers | Do the processes behind the numbers work? | Is the data safe and the system reliable? |
| Standard | ISAE 3402 (IAASB) | Trust Services Criteria, often via ISAE 3000 |
| Origin | International / EU | United States (AICPA) |
| US equivalent | SOC 1 | SOC 2 (already the US standard) |
| Typical users | Payroll, invoicing, fund administration | SaaS, cloud, IT service providers |
| Who reads the report | Your customer’s accountant | Your customer’s security and procurement teams |
When do you choose which?
The choice depends on what customers outsource to you. Simply ask them: what does their security questionnaire or RFP say?
Choose ISAE 3402 if:
- You process payroll, invoicing or transactions for customers
- Your customer’s accountant asks for assurance for the annual audit of their accounts
- You mainly serve European or international customers
Choose SOC 2 if:
- You offer SaaS, cloud or hosting
- Customers include you in their vendor risk management
- You want to win many American enterprise customers
Choose both if:
- Your service affects the numbers and also processes sensitive data
- Think of a payment processor: transactions (ISAE 3402) and credit card data (SOC 2)
ISAE 3402 does not replace SOC 2, and the other way round. If your customer’s accountant asks for ISAE 3402, they will not accept a SOC 2 report. They are separate standards for separate questions.
The relationship with ISAE 3000
This often causes confusion. There are two ISAE standards you will come across:
- ISAE 3402: specific to financial reporting controls. Belongs to SOC 1.
- ISAE 3000: general, for all assurance outside financial history. Belongs to SOC 2.
A Dutch accountant therefore usually delivers your SOC 2 as an “ISAE 3000 SOC 2 report”. It meets both frameworks. For your American customers, it is simply a SOC 2 report. You can read more about this in the frequently asked questions.
More information
- What is SOC 2: complete introduction
- SOC 2 vs SOC 1: the American counterpart of ISAE 3402
- SOC 2 in the Netherlands: how ISAE 3000 works here
- Costs and timeline: what a SOC 2 project costs
- IAASB ISAE 3402 : official standard setter