Register EDP Auditor and SOC 2: can an RE auditor issue the report?
An RE (Register EDP Auditor) is an IT auditor registered with NOREA , the professional body for IT auditors in the Netherlands. According to Kiwa , a SOC 2 examination uses the ISAE 3000 guidance, and NOREA published guidance for SOC 2 reports in 2016. An RE may therefore issue a SOC 2 report under ISAE 3000, provided they are independent of your organisation. Note that NOREA calls that report a SOC 2 equivalent. Strictly speaking, an AICPA report is work done by a CPA firm. Read more about the Dutch context and the difference with ISAE 3402.
This is an overview of the main points, not legal advice. Whether a specific auditor may sign a specific SOC 2 report depends on NOREA’s professional rules and the terms of the engagement. Always confirm this before you hire an auditor.
What exactly is an RE auditor?
NOREA grants the RE title. You complete a recognised IT audit postgraduate programme (NOREA mentions at least 4,500 study hours) and then need to show at least three years of practical experience. An RE commits to NOREA’s conduct and professional rules. According to NOREA itself, around 1,800 RE auditors are registered. NOREA also reports that the organisation is accredited by the NBA (Netherlands Institute of Chartered Accountants).
That makes the RE title different from the registeraccountant (RA, Dutch chartered accountant). An RA is primarily a financial auditor. An RE specialises in IT controls, information security and the controls that go with them. For a SOC 2, the focus is on that second category: access management, logging, change management and back-ups.
| Question | Answer in practice |
|---|---|
| Who grants the title? | NOREA, not the NBA |
| What is the education requirement? | Recognised IT audit postgraduate programme (at least 4,500 study hours) |
| How much experience is needed? | At least three years of practical experience |
| What does the title involve? | Registration and NOREA’s conduct and professional rules |
| Where do you check this? | On the NOREA website |
Which standard fits a SOC 2 in the Netherlands?
A SOC 2 is at its core an assurance report on your security controls, based on the Trust Services Criteria from the AICPA. In the Netherlands, that report is carried out under ISAE 3000, the international standard for assurance engagements other than audits or reviews of historical financial information. NOREA describes the result as a SOC 2 equivalent based on the AICPA criteria. The auditor gives an opinion on the description of your system and the operation of your controls, and records that in a report.
Two things need to be kept separate. One is the content of the report, the other is the authority of the auditor who signs it. An RE auditor can carry out an ISAE 3000 engagement. Several advisory firms say a report under the AICPA standards itself is signed by a US-licensed CPA firm. That is why a Dutch report is not automatically accepted everywhere. We cover this question on the page about American clients and a Dutch auditor.
The example: a SaaS company in Utrecht
A fictional example. A SaaS company with twenty employees wants a SOC 2 Type II report. It looks for an auditor and finds three providers:
| Provider | Auditor title | Standard | Fits this need? |
|---|---|---|---|
| Firm A | RE, registered with NOREA | ISAE 3000 | Yes, for Dutch and European clients |
| Firm B | Consultant without audit authority | No assurance | No, this is readiness work, not a report |
| Firm C | RA (registeraccountant) with IT audit experience | ISAE 3000 | Unconfirmed: ask whether the engagement falls within their authority |
The company chooses Firm A, but first asks in writing whether the RE auditor may sign the SOC 2 report under ISAE 3000 and whether the underlying controls fall within the scope of their authority. The answer goes into the engagement confirmation. This stops you from ending up, after six months of work, with a report your client does not accept.
Checklist before you hire an RE auditor
- Is the auditor on the NOREA register? Check the name and registration number.
- Which standard does the auditor use for the SOC 2 report? Ask for ISAE 3000 or another well-founded standard.
- Is the auditor independent? A party that set up your controls may not assess them itself.
- Is the engagement in writing, with the scope and the Trust Services Criteria included?
- Does your client know which standard they accept? This is the question that stalls most processes.
Common mistakes
Mixing up the title and the authority. “An RA or RE can do anything” is not true. The title says something about the register and the education. Whether an auditor may sign a specific report follows from the professional rules and the engagement.
Going only by the title. An auditor who calls themselves an “IT auditor” is not automatically an RE. Check the register.
Having the report signed by a party that also set up the controls. Then there is no independence. That party can at most help with preparation, as described on the page about the internal auditor.
No agreement on the standard. Many companies only discover at the end that their client asks for a different standard. Agree this in advance.
What can you expect from an RE auditor?
An RE auditor delivers more than a signature. With a good engagement, you receive the following parts, and you can discuss them in advance.
- An engagement confirmation with the scope, period and the Trust Services Criteria included.
- A schedule that matches your observation period, so the test data fits the period your client wants to see.
- A short list of the documents the auditor wants to see, given in advance rather than halfway through the engagement.
- An explanation of any exceptions, with the time needed to discuss them.
- An auditor’s statement that names the standard under which the report was prepared.
Pay attention to the last point. A statement that does not mention the standard is harder to explain to a client. Ask your auditor to include that mention explicitly.
A short check before you sign
Go through these questions with your auditor. It takes fifteen minutes and prevents the biggest trouble later.
- On what basis are you allowed to sign this SOC 2 report?
- Which standard do we follow, and is it usable for our clients?
- Who in our team is the point of contact, and who decides on exceptions?
- What happens if the observation period runs longer than planned?
- May we share the report with clients, and under what conditions?
The answers record where you stand. Write them down in the engagement file.
More information
- What is SOC 2? – the main page of this section
- SOC 2 in the Netherlands – the Dutch context, ISAE 3000 and NOREA
- ISAE 3402 vs SOC 2 – which assurance standard fits
- American clients and a Dutch auditor – what to do if your client wants an AICPA report
- The audit process – what the auditor does
Sources
- NOREA – register and professional rules for RE auditors
- Accountant.nl on the NOREA SOC 2 guidance (2016) – NOREA calls the result a SOC 2 equivalent under standard 3000
- Kiwa on ISAE and SOC reports – Kiwa (a certification body, not a regulator) states that the ISAE 3000 guidance is used for SOC 2
- AICPA SOC services – the US framework; the AICPA describes SOC services as work that CPAs can offer