ISAE 3000 audit

What is ISAE 3000?

ISAE stands for International Standard for Assurance Engagements. This is an assurance standard for outsourced processes and/or services. Your customers might ask you for an independent opinion on the quality of your service provision to demonstrate that you are in control of the processes they have outsourced to you. You can offer them peace of mind by presenting them with an ISAE 3000 assurance report. ISAE 3000 is a generic standard that can be applied to a wide range of issues, including the security of personal data (GDPR) and the timing of deliverables.

What is the difference between an ISAE 3000 Type I and Type II report?

There are two types of ISAE 3000 reports, i.e. Type I and Type II. What are they and what is the difference between these two types of reports? First off, we should say that there are many similarities between the two types. The difference lies mainly in the level of scope. A Type I report provides assurance on the design and the existence of the internal controls at a specific point in time. A Type II report provides assurance on the design, existence and operational effectiveness of the internal controls over a specific period of time, usually at least three months.

How is an ISAE 3000 audit different from an ISAE 3402 or SOC 2 audit?

The ISAE 3402 standard applies if financial processes have been outsourced to a service organisation, such as a provider of payroll accounting, back-office, asset management or credit management services. An ISAE 3402 report addresses the service organisation’s management of risks associated with these financial processes. The internal control objectives and controls are optional and subject to the auditor’s professional judgement.

SOC stands for System and Organisation Controls. A SOC 2 or ISAE 3000 audit focuses not only on financial processes but also on the Trust Services Criteria defined by the American Institute of Certified Public Accountants (AICPA). These Trust Services Criteria are security, availability, processing integrity, confidentiality and privacy. As a result, SOC 2/ISAE 3000 is much more targeted at information security and privacy than ISAE 3402, which focuses exclusively on financial processes.

Why would an ISAE 3000 audit be useful for my business?

An ISAE 3000 audit is particularly useful for businesses that want to provide assurance on their storage, processing or use of non-financial information, such as customer or third-party data, to their customers or users. The sector they operate in is irrelevant; it is mainly about specific characteristics such as a high level of automation. Examples of such businesses are cloud service providers, hosting parties, data centres and Software-as-a-Service (SaaS) platforms that are looking to provide assurance on security services and privacy control (including GDPR) and – in the Netherlands – ENSIA and DigiD.

Organisations governed by the Dutch Financial Supervision Act or the Dutch Pensions Act must be able to demonstrate that they are in control of their financial and other processes, which makes an ISAE 3000 assurance report a relevant proposition for providers of services to banks, notaries, pension funds and insurance companies.

Obtaining an ISAE report

For us to be able to issue an ISAE 3000 report, you need to have in place a framework of standards we can use as a benchmark. We will describe this framework and your internal control structure in our report. Aspects that will potentially be covered include your organisational and consultation structure, objectives, risk management procedures, supervision and internal controls. As a result, our report will not only offer your customers insight into the reliability and quality of your service provision, but it will also give them confirmation in a third-party memorandum (TPM) that you have internal controls in place and that these controls are effective.

Want to make the right start with ISAE 3000? We can help by:

• Setting up a framework for you.
• Having our certified IT auditors review your framework.