ISAE 3402 and ISAE 3000
Assurance for Service Organisations
ISAE 3402 and ISAE 3000 support third-party assurance reports used by your customers and their auditors. Basenorm centralises the control description, design and operating effectiveness evidence, auditor collaboration and readiness tracking in one place.
Control Description and Scoping
Define service commitments, system description and control objectives, and map them to the Unified Control Library for consistency across frameworks.
- System description and services in scope
- Control objectives or trust criteria
- Subservice organisations and carve-outs
- Complementary user entity controls
- Mapping to ISO 27001, SOC 2 and sector frameworks
Control Objectives
Service OrganisationControls mapped to client ICFR objectives
ISAE 3402 Type 2 control matrix
Assurance Scope
Financial Reporting
- ICFR Controls
- User Entity Controls
- SOC 1 Equivalent
Non-Financial
- IT Controls
- Compliance
- ESG/Sustainability
Report Type Selection
Type 2
6-12 months
Type 1
Point-in-time
Financial vs non-financial assurance
Type 1 and Type 2 Evidence
Collect design and operating effectiveness evidence throughout the reporting period, with automated pulls from connected systems and reviewer workflows.
- Type 1 evidence as at a specific date
- Type 2 evidence over the reporting period
- Automated evidence collection from SaaS and infrastructure
- Sampling, testing and exception tracking
- Auditor-ready workspace with traceable evidence
Auditor Collaboration and Reporting
Work with your service auditor in a structured workspace with request lists, deliverables and issue tracking, so reports are produced efficiently and consistently.
- Structured auditor request lists and deliverables
- Issue tracking and remediation workflows
- Management assertions and assurance letters
- Reuse of evidence for SOC 2 and ISO 27001
- Continuous readiness between reporting cycles
Auditor Report
"Controls were suitably designed and operating effectively throughout the period..."
23
Controls Tested
22
Effective
1
Exception
Ready for a smoother ISAE engagement?
Join service organisations using Basenorm to prepare, evidence and deliver ISAE 3402 and ISAE 3000 reports with continuous readiness.