ISAE 3402 and ISAE 3000
ISAE 3402 and 3000 assurance on your controls.
An ISAE report gives your customers and their auditors assurance about the controls at your organisation. ISAE 3402 covers controls relevant to financial reporting, ISAE 3000 other subjects such as information security. With Basenorm you organise controls and evidence for both on your ISO 27001 ISMS.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- Assurance reportIssued by an independent auditor
- ISAE 3402
- Financial reportingControls at a service organisation relevant to its customers
- ISAE 3000
- Other subjectsOften information security or privacy
- Report
- Type I or Type IIDesign, or operation over a period
01 / What an ISAE report covers
What an ISAE report
looks at.
You describe your control objectives and the controls that meet them. The auditor gives an opinion on that description and on the controls.
- 1System description
A description of your services and the systems and processes behind them.
- 2Control objectives
The objectives your controls must achieve, agreed with your auditor.
- 3Controls
The controls you operate to meet each objective.
- 4Evidence of operation
For Type II, evidence that controls operated over the whole period.
- 5Complementary user entity controls
The controls your customers must operate themselves.
- 6Management assertion
A written statement by your management about the description and the controls.
02 / With your ISMS
ISAE on what you already have.
| Topic | Your ISO 27001 ISMS | What ISAE adds |
|---|---|---|
| Controls | Annex A controls | Control objectives and controls described for your customers |
| Evidence | Evidence for your ISMS | Evidence of operation over the full period for Type II |
| Scope | ISMS scope | A system description that fits your services |
| Customers | Supplier and customer agreements | Complementary controls that your customers operate |
An ISMS is a strong base for an ISAE 3000 report on information security. Your auditor decides whether the controls meet the objectives.
03 / The assessment
ISAE 3402 · ISAE 3000How an ISAE report
is assessed.
ISAE reports are issued by an independent auditor. In the Netherlands these are usually chartered accountants or IT auditors.
Read about ISO 27001Design. The auditor assesses whether the controls are suitably designed at a point in time.
Operating effectiveness. The auditor tests whether the controls operated effectively over a period, often a year.
For your customers. Customers and their auditors use the report in their own control environment.
ISAE 3402 and ISAE 3000 are standards of the International Auditing and Assurance Standards Board (IAASB).
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which ISO 27001 controls also serve your ISAE control objectives.
02Governance Graph
Connect services, control objectives, controls, evidence and owners.
03AskNorman
Ask what is still open for your ISAE report, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
ISAE.
ISAE 3402 or ISAE 3000?
ISAE 3402 covers controls relevant to your customers’ financial reporting. ISAE 3000 is used for other subjects, such as information security or privacy.
How does ISAE relate to ISO 27001?
ISO 27001 is a certifiable management system. An ISAE report is an opinion by an auditor on specific controls. Many ISO 27001 controls can serve as a base for an ISAE 3000 report.
What is the difference between Type I and Type II?
Type I looks at the design of your controls at a point in time. Type II also tests whether they operated effectively over a period.
Does Basenorm issue the ISAE report?
No. The report is issued by an independent auditor. Basenorm helps you organise control objectives, controls and evidence.
Book a demo
Build your ISAE report on your ISMS.
In a demo we look at your services, your controls and what an ISAE report asks.
- Which ISO 27001 controls fit your control objectives.
- How you collect evidence for a Type II period.
- How you manage controls for several reports.
Hosted in the Netherlands. Your data stays in the EU.