SOC 2, ISAE 3000 and ISAE 3402 are all independent assurance reports on a service organization's controls, issued under different standards. SOC 2 is the AICPA's report on controls against the Trust Services Criteria, issued by a licensed CPA firm and expected mainly by US buyers. ISAE 3402 is the international IAASB standard for reports on controls relevant to customers' financial reporting, the counterpart of SOC 1 rather than SOC 2. ISAE 3000 is the IAASB's general standard for assurance on non-financial subject matter, and it is the usual basis for a security assurance report outside the US, sometimes against the Trust Services Criteria themselves. Which one you need depends on what your buyers ask for and who their auditors are.
A European buyer asks for "a SOC 2 or equivalent". A US buyer asks for "a SOC 2". A customer's financial auditor asks for "an ISAE 3402". These requests overlap more than they seem, and knowing how the standards relate saves an examination nobody needed.
The three reports side by side
| Question | SOC 2 | ISAE 3000 | ISAE 3402 |
|---|---|---|---|
| Standard setter | AICPA | IAASB | IAASB |
| Subject matter | Controls against the Trust Services Criteria: security and, optionally, availability, processing integrity, confidentiality and privacy | Any non-financial subject matter against suitable criteria, often security controls | Controls at a service organization relevant to customers' financial reporting |
| Closest relative | ISAE 3000 on the Trust Services Criteria | SOC 2 when the criteria are the Trust Services Criteria | SOC 1 |
| Who issues it | A licensed CPA firm | A practitioner qualified in its jurisdiction, usually an audit firm | A practitioner qualified in its jurisdiction, usually an audit firm |
| Report types | Type 1 and Type 2 | Design at a date or operation over a period, by the same logic | Type 1 and Type 2 |
| Typical reader | US enterprise security and procurement teams | European security and procurement teams, regulated buyers | Customers' finance teams and their external auditors |
ISAE 3402 is not the European SOC 2
The most common confusion is treating ISAE 3402 as the international version of SOC 2. It is the international version of SOC 1: both cover controls that matter to a customer's financial statements, such as payroll, billing or fund administration. If your service does not touch your customers' financial reporting, an ISAE 3402 is usually the wrong report. The comparison of SOC 1, SOC 2 and SOC 3 covers that split in more detail.
Where ISAE 3000 fits
ISAE 3000 is a general standard for assurance engagements other than audits of financial information. For a SaaS or IT service provider it is the usual basis for a security assurance report outside the US. The criteria have to be suitable and stated in the report; common choices are the AICPA Trust Services Criteria, a control set based on ISO 27002, or criteria the service organization defines. An ISAE 3000 report on the Trust Services Criteria covers the same ground as a SOC 2, under a different standard and a different issuer.
One examination, more than one report
Because the controls and the testing overlap, many audit firms can issue more than one report from the same fieldwork: a SOC 2 and an ISAE 3000 on the Trust Services Criteria, or a combined SOC 1 and ISAE 3402 report. That only works if the firm, or a member firm in its network, is qualified to issue both, so ask which entity will sign each report before you agree the scope.
Which one to choose
- Your buyers are mostly US enterprises: a SOC 2.
- Your buyers are mostly European and ask for an assurance report on security: an ISAE 3000 report, or ISO 27001, which many European buyers treat as the default.
- You sell on both sides of the Atlantic: a SOC 2, with an ISAE 3000 from the same examination if European buyers ask for it by name.
- Your service feeds customers' financial statements: a SOC 1 or ISAE 3402, possibly alongside one of the above.
The ISO 27001 and SOC 2 comparison covers how a management-system certificate differs from an assurance report on controls.