# ISAE 3000: Assurance engagements other than audits of historical financial information

> The international assurance standard used for security, privacy and other non-financial control reports, often as the global counterpart to SOC 2.

URL: https://securei3.com/standards/isae-3000/
Category: Attestation & assurance: Attestation / assessment
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


ISAE 3000 (Revised) is the International Standard on Assurance Engagements for reports other than audits or reviews of historical financial information. Service organisations use it to give customers independent assurance over security, privacy, availability and other controls, in Type I (design) or Type II (operating effectiveness) form.

We define the scope and criteria, design and test controls, prepare the system description and arrange the engagement through our partner audit firms, so you have one point of contact from readiness to report.

## Who it is for

- Service providers with European, Middle Eastern or Asian customers
- Companies asked for an independent report on security or privacy controls
- Organisations reporting on ESG or other non-financial information

## Benefits

- An internationally recognised assurance report
- Can cover security, availability, privacy or other control objectives
- Reuses ISO 27001 and SOC 2 control work

## How Secure iQube helps

1. **Scoping**: Agree the systems, services and criteria in scope, and whether a Type 1 or Type 2 report fits your customers and timeline.
2. **Readiness assessment**: Map existing controls to the criteria, identify gaps and design missing controls with owners and evidence.
3. **Remediation**: Put policies, tooling and processes in place, and rehearse evidence collection so it is routine, not a scramble.
4. **Assurance through our audit partners, or yours**: We can arrange the assurance engagement with one of our partner audit firms, so you have one point of contact from readiness to report. If you already have an auditor, we work alongside them instead.
5. **Observation period and report**: For Type 2, we monitor controls through the observation window and help you respond to exceptions before the report is issued.

## Frequently asked questions

### Is ISAE 3000 the same as SOC 2?

They are similar in purpose. SOC 2 follows AICPA standards and the Trust Services Criteria; ISAE 3000 is the IAASB standard and can use the Trust Services Criteria or other criteria. Many providers issue an ISAE 3000 report for non-US customers.

### Who issues an ISAE 3000 report?

A qualified audit firm. We can arrange the engagement through our partner audit firms, or work with your existing auditor.

Related: https://securei3.com/standards/soc-2/, https://securei3.com/standards/isae-3402/, https://securei3.com/standards/iso-27001/

Contact: https://securei3.com/contact/: info@securei3.com