ISAE 3402 or SOC 2: which report do your clients ask for, and can one audit give you both?

ISAE 3402 and SOC 2 get mixed up constantly in proposals, tenders and vendor assessments. That is understandable. Both are assurance reports issued by an independent auditor on the internal controls of a service organization, both come in a Type I and a Type II, and both are requested by clients who want assurance about their supplier. Yet they answer different questions. If you pick the wrong report, you find out when a client or their auditor refuses to accept it, and by then you are months down the road.

The core question: what does your service touch at the client?

The choice starts with one question: what does your service affect at your client? If it affects the financial statements, you are in ISAE 3402 territory. If it mainly affects the security, availability or confidentiality of data, you are in SOC 2 territory.

ISAE 3402 was developed for outsourced processes that influence clients' financial reporting: payroll processing, pension administration, investment administration, billing, payment processing. Your client's auditor uses the report in the financial statement audit. What exactly goes into such a report is covered in what is ISAE 3402.

SOC 2 was developed for service providers that process or host client data, and tests against the five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Only security is mandatory; the other categories are selected based on your service. The report is read by security and procurement teams at (prospective) clients, not primarily by their accountant. More on that in SOC 2 explained.

Origin and formal basis

ISAE 3402 is a standard of the international IAASB and is used worldwide, with its center of gravity in Europe. The American counterpart is SOC 1, which a US CPA firm performs under SSAE 18. The two are close in substance but not identical: the requirements on the auditor come from different professional rules. A single engagement can, however, meet both standards at once.

SOC 2 is a framework of the American AICPA. Outside the US, auditors generally issue the report under ISAE 3000, the broad international assurance standard. You then see a report that is SOC 2 in substance (Trust Services Criteria) with an ISAE 3000 opinion on top. Note what this means for the comparison: ISAE 3402 is the international counterpart of SOC 1, not of SOC 2. SOC 2 and ISAE 3402 are not variants of each other; they are reports for a different question.

The practical differences

Scope. ISAE 3402 revolves around control objectives the organization formulates itself around its financially relevant processes. SOC 2 tests against a fixed external framework of criteria. That makes SOC 2 reports more comparable across providers, and gives ISAE 3402 more room to tailor the report to the actual service.

The reader. An ISAE 3402 report lands with your client's auditor, who relies on it in the financial statement audit. A SOC 2 report lands with the CISO, the security officer or procurement, who use it to complete a vendor assessment. Both reports are meant for a limited audience: clients and their auditors. If you want to share something with the public, the SOC 3 report exists for that purpose, without the test details.

The structure. Both reports contain a system description, a management assertion and the auditor's opinion. The difference is what is tested against: under ISAE 3402 the control objectives from your own description, under SOC 2 the Trust Services Criteria you selected.

The observation period. In a Type II the auditor tests operating effectiveness over a period. ISAE 3402 does not prescribe a minimum duration, but in practice six months is treated as the lower limit, because a client's auditor has to perform additional work on a shorter period. For SOC 2 the AICPA does not prescribe a minimum either; three months does occur for a first report, and six to twelve months is customary. More on setting up that period in the observation period for ISAE 3402 Type II and in Type I versus Type II for SOC 2.

Geography. In European tenders and with European accountants, ISAE 3402 is the established name. American and international tech companies ask for SOC 2 by default. But this is a rule of thumb, not a law: look at what your clients actually put in their contracts and questionnaires.

When both?

Many organizations fit both descriptions at once. A cloud-based payroll provider affects clients' financial statements (ISAE 3402) and processes large volumes of personal data in a SaaS environment (SOC 2). An investment administrator delivers figures for the financial statements and hosts a client portal at the same time.

In those cases the efficient route is usually a single combined audit. A large share of the controls, such as access management, change management, backup and incident management, is relevant to both reports and then only needs to be tested once. The auditor reports the same test results in two reports, each with its own structure and its own audience.

A combined audit does not mean two reports for the price of one. You still have two system descriptions, two management assertions and two opinions, and the scope does not have to match: the system boundary for SOC 2 can be wider than the financially relevant processes for ISAE 3402. The saving is in the testing and the planning, not in the reporting.

Points that apply to both

Subservice organizations. If you use a hosting provider or another subcontractor for part of the service, you have to choose between the carve-out and the inclusive method in both reports. That determines whether that party's controls are tested in your report or only named. The starting point and the consequences for your client are set out in carve-out versus inclusive method.

Complementary user entity controls. Both reports state what your client has to do for the control environment to hold, for example removing access for their own staff on time. A client who skips that cannot rely on the report to cover their risk.

Choosing in three steps

Step one: inventory what clients and prospects actually ask for. Check contracts, tenders and due diligence questionnaires from the past year. "Do you have an ISAE 3402?" from a client's auditor is a different question than "do you have a SOC 2?" on a security questionnaire.

Step two: determine whether your service affects clients' financial statements. If in doubt, reverse the question: would your client's auditor want to know whether your process works correctly when auditing the financial statements? If yes, there is an ISAE 3402 question.

Step three: choose the smallest set of reports that covers the demand, and plan the combination if both are needed. Do not start two separate engagements with two firms; that means duplicate testing for your team. What a SOC 2 engagement costs depends heavily on scope and period, see what a SOC 2 engagement costs.

Read more about the approach per report: the ISAE 3402 audit and the SOC 2 audit.