What is ISAE 3402?
ISAE 3402 is the international assurance standard under which an independent auditor reports on the controls at a service organisation that are relevant to its customers’ internal control over financial reporting. Its full title is Assurance Reports on Controls at a Service Organization, and it was issued in December 2009 by the IAASB, the standard setter of the International Federation of Accountants (IFAC). An ISAE 3402 report shows customers and their auditors that outsourced processes, such as payroll, hosting or application management, are demonstrably under control.
For IT/OT convergence, ISAE 3402 matters mainly as supplier evidence for IT services in the financial chain. It says little about the security of production systems.
🧠 How does an ISAE 3402 report work?
Four parties are involved in ISAE 3402: the service organisation (the supplier), the user entities (the customers), the service auditor who performs the audit and writes the report, and the user auditor. The user auditor relies on the report during the financial statement audit under ISA 402, the auditing standard for entities that use a service organisation. ISAE 3402 is its counterpart.
The standard is assertion-based. Management of the service organisation writes its own system description and a written assertion that the description is fairly presented and that the controls are suitably designed and operating effectively. The auditor then gives a reasonable assurance opinion on that assertion. This keeps the responsibilities of supplier and auditor clearly separated.
A report usually contains five parts:
- Service auditor’s assurance report - the opinion, including any qualifications
- Management’s assertion - the written statement of the service organisation
- System description - services, processes, systems and organisation
- Control objectives and controls - for example for access control, change management and backup
- Tests of controls and results - Type II only, including exceptions
The IAASB standard requires any work of the internal audit function that the service auditor uses to be identified separately in the description of tests.
🔄 What is the difference between Type I and Type II?
| Feature | Type I | Type II |
|---|---|---|
| Opinion on the description | Yes, fair presentation | Yes, fair presentation |
| Opinion on design | Yes, suitability of design | Yes, suitability of design |
| Opinion on operation | No | Yes, operating effectiveness over a period |
| Point in time | A single date | A period, typically 6 to 12 months |
| Tests described | No | Yes, with nature, extent and results |
| Value for the customer | Starting point, first year | Evidence that controls actually work |
A Type I report is often a stepping stone in the first year. Auditors and regulators usually ask for a Type II report, because only that shows controls operated over time. With a Type II report, always read the test exceptions: an unqualified opinion can still contain deviations that matter for your situation.
🧱 What does ISAE 3402 not cover?
The IAASB explicitly limits the scope to controls relevant to customers’ financial reporting. The standard itself names, as an example of what falls outside ISAE 3402, controls that affect a customer’s production or quality control. That is exactly the OT domain.
If you need assurance over security, availability or confidentiality, ISAE 3000 is the right basis: the general assurance standard for non-financial subject matter. In the United States this is a SOC 2 report based on the AICPA Trust Services Criteria. NOREA, the Dutch professional body for IT auditors, published guidance in 2016 for an equivalent SOC 2-style report for Dutch IT service providers, noting that ISAE 3402 had sometimes been misused for security topics.
Two other pitfalls:
- Carve-out of subservice organisations - if the supplier itself relies on a data centre or a cloud platform, those controls may be excluded from scope (carve-out). Under the inclusive method they are tested as well.
- Complementary User Entity Controls (CUECs) - controls the supplier expects you as the customer to perform, such as revoking accounts on time. If you do not perform them, the report gives you less assurance.
🔁 How does ISAE 3402 relate to other standards?
| Standard or report | Subject | Relationship to ISAE 3402 |
|---|---|---|
| SOC 1 (SSAE 18) | Financial reporting | US counterpart; similar in substance |
| SOC 2 / ISAE 3000 | Security, availability, confidentiality, processing integrity, privacy | Complementary; better suited for cybersecurity |
| ISO 27001 | ISMS certification | Certifies the management system, not the operation of specific controls |
| IEC 62443-2-4 | Security requirements for OT service providers | Best fit for OT integrators and maintenance contractors |
| COBIT | IT governance and control | Common source of the control objectives in the report |
Internationally, ISAE 3402 replaced the US SAS 70 report. In the US, SSAE 16 followed with the same effective date, and then SSAE 18, which applies to reports dated on or after 1 May 2017. In the Netherlands, the professional body NBA translated the standard as Standaard 3402. The standard applies to reports covering periods ending on or after 15 June 2011.
🏭 Where is ISAE 3402 relevant in an IT/OT environment?
In a manufacturing company, ISAE 3402 mainly touches the IT side of the chain. Think of ERP hosting, payroll and invoicing processes, or an MES interface whose production counts flow into the financial administration. Typical control objectives in such a report are:
- Logical access - IAM, RBAC and periodic access reviews
- Change management - approval and testing of changes to applications and interfaces
- IT operations - backups, job scheduling and incident management, often organised along ITIL lines
- Physical security - access to data centres and server rooms
An OT service provider with remote access to your PLCs, SCADA or other OT assets, who runs a jump server or rolls out patches, is better placed to demonstrate its security with an ISAE 3000/SOC 2 report or an IEC 62443-2-4 certificate. Combine that with your own controls such as session recording, monitoring and an up-to-date asset inventory.
🔧 How do you assess a supplier’s ISAE 3402 report?
- Check the scope - does the system description cover exactly the service, locations and systems you use?
- Check type and period - is it a Type II, and does the period line up with your financial year? Ask for a bridge letter to cover any gap.
- Read the opinion - is it unqualified, or qualified for one or more control objectives?
- Analyse the exceptions - which tests failed, and how did management respond?
- Check subservice organisations - carve-out or inclusive, and do you have separate assurance from those parties?
- Assign the CUECs - appoint internal owners for the controls the supplier expects from you.
- Record the outcome - add the findings to your third-party risk management and your risk register.
For Dutch organisations covered by the Cyberbeveiligingswet, the Dutch implementation of NIS2, supplier management is part of the duty of care. An ISAE 3402 report helps for IT services with financial impact, but it does not replace supplier security requirements for OT.
❓ Frequently asked questions
Is ISAE 3402 a certification?
ISAE 3402 is not a certification but an assurance report containing an opinion from an independent auditor. The report is intended for the service organisation’s customers and their auditors, not for general use. That is why you usually receive it under a confidentiality agreement.
Who can issue an ISAE 3402 report?
An ISAE 3402 report is issued by an independent practitioner who complies with the professional rules for assurance engagements. In the Netherlands these are registered accountants (RA) or registered IT auditors (RE) affiliated with NOREA, often working in a mixed team. The service organisation itself provides the system description and management’s assertion.
What is the difference between ISAE 3402 and SOC 1?
ISAE 3402 is the international standard of the IAASB, while SOC 1 is the US version of the AICPA under SSAE 18. In substance they are comparable: both cover controls relevant to customers’ financial reporting. Suppliers with both US and European customers often have a single combined report prepared.
How long is an ISAE 3402 Type II report valid?
An ISAE 3402 Type II report has no formal validity period, but it describes a closed period of typically six to twelve months. Users therefore expect a new report every year. For the time between the end of the period and your balance sheet date, the supplier often provides a bridge letter.
Is ISAE 3402 suitable for assessing OT suppliers?
ISAE 3402 is of limited use for OT suppliers, because the standard explicitly places controls over production and quality control outside its scope. For the security of OT services, an ISAE 3000 or SOC 2 report and an IEC 62443-2-4 certificate are a better fit. ISAE 3402 remains useful for IT services that affect your financial administration.
Does ISAE 3402 replace an ISO 27001 certificate?
ISAE 3402 and ISO 27001 do not replace each other. ISO 27001 certifies that an organisation has a working information security management system, whereas ISAE 3402 tests the operation of specific controls relevant to financial reporting. Many service providers therefore hold both.
📌 In summary
ISAE 3402 is the international assurance report on a service provider’s controls that affect customers’ financial reporting, with a Type II opinion on how those controls operated over a period. For IT/OT convergence it is useful evidence for IT services such as ERP hosting, but for the security of OT suppliers ISAE 3000/SOC 2 and IEC 62443-2-4 are a better fit. Assess every report on scope, period, exceptions, subservice organisations and the controls you must perform yourself.