ISAE 3402 vs. SOC 2 is a comparison that gets asked constantly and rarely makes sense as posed, because the two reports don’t cover the same ground. ISAE 3402 evaluates a service organization’s controls that affect its clients’ financial reporting. SOC 2 evaluates operational controls around security, availability, processing integrity, confidentiality, and privacy. Picking between them isn’t really a choice between competing standards; it’s a question of which risk your clients care about, and some organizations end up needing both.
What Each Report Actually Covers
ISAE 3402: Controls Over Financial Reporting
ISAE 3402 is issued by the International Auditing and Assurance Standards Board and focuses specifically on controls at a service organization that affect user entities’ financial reporting.1International Auditing and Assurance Standards Board. Staff Overview – International Standard on Assurance Engagements 3402, Assurance Reports on Controls at a Service Organization It’s the framework you’d expect a payroll bureau, investment administrator, loan servicer, or claims processor to hold, because those organizations touch numbers that flow into their clients’ financial statements.
Under ISAE 3402, the service organization defines its own control objectives based on the financial-reporting risks its clients face. A payroll processor might identify controls covering wage calculation accuracy, tax withholding, and payment file transmission. The auditor then tests whether those self-defined objectives are met. Because objectives are management-defined rather than pulled from a fixed checklist, two ISAE 3402 reports from different service organizations can look quite different in scope.
SOC 2: Security and Operational Controls
SOC 2 is governed by the AICPA and uses a standardized set of requirements called the Trust Services Criteria, organized into five categories: security, availability, processing integrity, confidentiality, and privacy.2AICPA & CIMA. System and Organization Controls: SOC Suite of Services Security, built around nine Common Criteria derived from the COSO framework, is mandatory in every SOC 2 engagement and covers access controls, system monitoring, incident response, and change management. The other four categories are optional; management picks based on the nature of the service and what clients expect.
The Trust Services Criteria are principle-based rather than prescriptive. They don’t mandate specific firewalls, intrusion detection systems, or multi-factor authentication by name. They require that controls exist to restrict logical and physical access, detect anomalies, and respond to incidents; the specific tools are up to the organization. That’s why the same criteria can apply to a cloud infrastructure provider and a document management company whose technology stacks look nothing alike.
Organizations handling sensitive personal information often add privacy and confidentiality to their SOC 2 scope. Regulatory obligations under laws like HIPAA or the Gramm-Leach-Bliley Act frequently drive that choice, even though SOC 2 itself is not a regulatory compliance certification.
The Comparison People Usually Mean to Make
If you’re weighing ISAE 3402 against SOC 2, there’s a good chance you’re comparing the wrong pair. The functional equivalent of ISAE 3402 is SOC 1: both cover controls over financial reporting, and they’re issued by different bodies for different geographic markets. The functional equivalent of SOC 2 in the international standards is ISAE 3000, which the IAASB issues for assurance engagements on subject matter other than historical financial information.3International Auditing and Assurance Standards Board. International Standard on Assurance Engagements (ISAE) 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information
That matters when you talk to clients. Asking whether you should get ISAE 3402 or SOC 2 is like asking whether you should get a financial audit or a cybersecurity assessment; the answer depends on which risk you’re being asked to address. If a prospect says they need “the international version of SOC 2,” they usually mean a SOC 2 report backed by ISAE 3000, not ISAE 3402.
Who Issues the Standards
The IAASB operates under the International Federation of Accountants and issues ISAE 3402 as a global standard for assurance engagements on service organization controls.1International Auditing and Assurance Standards Board. Staff Overview – International Standard on Assurance Engagements 3402, Assurance Reports on Controls at a Service Organization These engagements are performed by professional accountants in public practice under the IAASB’s broader assurance requirements.
The AICPA governs the entire SOC suite, including SOC 1, SOC 2, and SOC 3. SOC engagements are performed by licensed CPAs under Statement on Standards for Attestation Engagements No. 18, which remains the current attestation standard as of early 2026.4AICPA & CIMA. AICPA SSAEs – Currently Effective SSAE 18 sets the professional requirements for how auditors plan, execute, and report on attestation engagements, including the risk assessment procedures that underpin every SOC examination.5AICPA & CIMA. AICPA Statement on Standards for Attestation Engagements No. 18
Where Each Report Is Expected
ISAE 3402 carries recognition across Europe, Asia, and other international markets because the IAASB’s standards are adopted or referenced by regulators and financial institutions in many countries. Service providers with a multinational client base often use ISAE 3402 to satisfy diverse compliance requirements at once, particularly when clients’ external auditors need assurance over outsourced financial processes. International banks commonly require ISAE 3402 reports from vendors processing transactions, reconciliations, or account servicing on their behalf.
In the United States, procurement and risk teams in SaaS, cloud computing, and data processing sectors almost universally expect a SOC 2 report. AICPA standards are deeply embedded in American financial and regulatory practice, and SOC 2 has become the default credential for demonstrating operational security. Companies expanding into the U.S. market usually find SOC 2 is a gating requirement for enterprise sales; those expanding internationally hit the same dynamic with ISAE 3402 on the financial side.
Because ISAE 3402 and SOC 1 cover the same scope, organizations serving both U.S. and international clients on the financial reporting side often produce a combined SOC 1/ISAE 3402 report in a single engagement, satisfying auditors on both sides of the Atlantic. There is no equivalent shortcut between SOC 2 and ISAE 3402, because they address different subject matter.
When You Need Both
Some service organizations genuinely need an ISAE 3402 (or SOC 1) report and a SOC 2 report. It’s common for companies that process financial data on a cloud platform, or that support both business administration and IT operations for their clients. A managed services provider handling accounts payable processing while also hosting client applications has financial reporting risks that call for ISAE 3402 or SOC 1 and operational security risks that call for SOC 2.
Running two entirely separate engagements is expensive, but a coordinated approach can reduce duplication. Many controls, particularly around access management, change management, and monitoring, matter for both frameworks. A skilled audit firm can align the engagements so evidence gathered for one feeds into the other. The scopes and criteria still have to be defined carefully, because each report has to meet its own assurance objective.
Type I and Type II Reports
Both ISAE 3402 and SOC 2 come in two forms. A Type I report evaluates whether controls are properly designed and implemented as of a single date. It answers whether the right controls existed on that day. It’s a reasonable starting point for a first-time engagement, but most clients and auditors treat it as a stepping stone.
A Type II report tests whether those controls operated consistently over a defined period. The minimum window is typically six months, though most mature service organizations cover twelve months so there’s no gap in assurance. During the examination period, the auditor collects evidence like system access logs, change management records, employee training documentation, and incident response artifacts to verify that controls operated as described throughout.
Type II carries far more weight because it demonstrates sustained discipline, not a one-day snapshot. Starting with Type I is fine if you’ve never been through an engagement, but expect clients to push for Type II within the following year.
What It Costs
Professional fees for a SOC 2 Type II examination generally range from roughly $20,000 to $60,000 for a mid-sized organization. The variables are the number of Trust Services Criteria categories included, the complexity of the system, the number of subservice organizations, and whether it’s a first-year or repeat engagement. First-year engagements cost more because the auditor has to build an understanding of the system from scratch, and the organization often needs to remediate gaps identified during readiness work.
ISAE 3402 engagements fall in a similar range, though costs vary by country and by the depth of the control objectives. Pursuing both reports at once may earn some efficiency with the audit firm, but budget for a meaningful premium over a single engagement. None of this includes internal costs: documenting controls, gathering evidence, running internal testing, and closing gaps. For many organizations, the internal preparation effort exceeds the audit fee itself.
How to Decide
Start with what your clients actually rely on you for. If your service touches numbers that end up in their financial statements, ISAE 3402 or SOC 1 is the right framework, chosen by geography. If your service holds their data, runs their systems, or affects their uptime, SOC 2 is what buyers will ask for in the U.S., and an ISAE 3000 report is the corresponding international option. If both descriptions fit your service, plan for both reports and look for an audit firm that can coordinate the engagements rather than running them in parallel silos.