Will US clients accept a SOC 2 from a Dutch auditor?
It depends on what your client asks for. A SOC 2 that a Dutch IT auditor issues under ISAE 3000 is a different report from a SOC 2 under the AICPA framework, issued by a US CPA firm. NOREA (the Dutch professional body for IT auditors) itself calls the Dutch report a SOC 2 equivalent. The AICPA sets the US framework, and in the Netherlands the engagement is often carried out under ISAE 3000 . Ask your client in writing beforehand which standard they accept. Also read the Dutch context and the page on the RE auditor. RE stands for Register EDP-auditor, the Dutch register of IT auditors.
This is the question that slows down or derails most SOC 2 projects. It often comes up only at the end, when the report is already finished. Ask it in the first week.
Why the difference matters
At its core, a SOC 2 is a report from an independent auditor on your security controls. The content is comparable, but the framework the auditor works within differs. In practice, a US client often asks for an AICPA report, because that standard is common there. Whether a US client accepts an ISAE 3000 report differs per client. Ask before you choose an auditor.
That does not mean a Dutch report is worthless. It means you need to know which question your client is asking. “We have SOC 2” is not enough. The question is: which SOC 2, carried out by whom, under which standard?
The three questions your client might ask
| What the client asks | What you then need | Does a Dutch ISAE 3000 report fit? |
|---|---|---|
| ”A SOC 2 Type II report” with no further explanation | A Type II report, preferably under the AICPA framework | Often no, unless the client explicitly accepts ISAE 3000 |
| ”A SOC 2 from a recognised auditor” | An auditor the client recognises, with an explanation of their title and standard | Sometimes, as long as the authority and the standard are explained |
| ”Evidence of security, preferably international” | A report plus an explanation of the standard | Often yes, with a short explanation alongside the report |
This table reflects practice, not a fixed rule. Which form a client accepts is set out in their supplier assessment or purchasing terms. Ask them.
Example: a Dutch SaaS company with a US client
A fictional example. A Dutch SaaS company with fifty employees wants to win a US client. The client asks for a SOC 2 Type II report. The company has a Dutch RE auditor prepare an ISAE 3000 report. Six months later, the client’s purchasing department says it wants an AICPA report, because that is what its policy requires.
The company now has two options: start a second project with a CPA firm that issues AICPA reports, or negotiate the form. A second project costs time and money. Those costs were not in the original budget, see costs and timeline.
Had the company asked the question in the first week, it would have chosen the one project that fits. That is the whole point of this page.
What to ask in writing beforehand
A short email prevents a lot of trouble. A usable outline, in plain language:
Subject: Which SOC 2 format do you accept?
Hello [name],
We would like to have our security controls assessed with a SOC 2 Type II report.
Can you confirm whether you require a SOC 2 under the AICPA framework, or whether
an ISAE 3000 report from a Dutch IT auditor (RE) is sufficient?
If the ISAE 3000 report is sufficient, could you please confirm by email which
Trust Services Criteria you expect?
Kind regards,
[name]Send that email to the contact who handles suppliers, not only to the sales manager. Keep the answer in your file. It is the proof that you agreed the standard.
What the AICPA route involves
An AICPA report is issued by a CPA firm (CPA stands for Certified Public Accountant, the US accountancy title). According to the AICPA , CPAs can offer SOC services. Some advisory firms state that only a licensed CPA firm may sign such a report. This has not been verified in the AICPA text. For you, it usually means a different type of auditor, a different quote and a different timeline. It can also be a CPA firm with a Dutch team. Ask about that. Because the Trust Services Criteria are the same, much of the evidence you have already gathered remains usable. Read more about that evidence on the gathering evidence page.
Whether a specific CPA firm fits your scope and size, you need to check yourself. Compare them on their experience with SaaS companies and on how they define the scope of the engagement.
Common mistakes
Assuming “SOC 2” is the same everywhere. The name is the same, but the framework is not always. Ask about the standard.
Only looking for the words SOC 2 in the quote. Look at the wording of the auditor’s report and at the auditor’s authority.
Asking too late. Many clients only decide which format they accept at the end of their purchasing process. Ask early, and record the answer.
Thinking a bridge letter solves the problem. A bridge letter closes a gap in the period between two reports. It does not make a report under a different standard suitable for the client.
What if your client already accepts an ISAE 3000 report?
Then you are in luck, and you do not need to start again. Still, record what your client has accepted. An email is enough, but it must name the period, the scope and the standard.
Pay attention to the scope. If your client only uses the service described in the report, the position is simple. If the client also uses parts that fall outside the scope, a separate confirmation is needed. That can be a bridge letter, or a short explanation from your auditor.
Questions your client will probably ask
“Is your auditor independent of you?” Yes, and you explain that with a short statement from the auditor. An auditor who also helped you set up your controls raises questions.
“Which Trust Services Criteria do you cover?” Name them explicitly. Security alone is a different story from security plus availability and confidentiality.
“What is the observation period?” Give the exact dates. A six-month period is different from a twelve-month period, even if both are called “SOC 2”.
More information
- What is SOC 2?: the main page of this section
- SOC 2 in the Netherlands: ISAE 3000, NOREA and the Dutch question
- SOC 2 vs ISO 27001: if the client also asks about ISO 27001
- Type I vs Type II: which type fits your client’s question
- Frequently asked questions: all answers in one place
Sources
- AICPA SOC services : the US framework and who offers the services
- Kiwa on ISAE and SOC reports : ISAE 3000 as the standard for SOC 2 in the Netherlands
- NOREA : the Dutch professional body for IT auditors