ISAE 3402 reporting

Demonstrably reliable processes

More and more organisations outsource critical processes: payroll processing, invoicing, accounts receivable management, reporting or parts of their financial administration. You take over these processes, but responsibility for the annual accounts stays with your client and their accountant. As a result, accountants ask ever sharper questions about how you have organised your processes, which controls you carry out and how you deal with errors and incidents.

Without an ISAE 3402 report that often means bespoke work per client: extensive questionnaires, additional on-site audits and the same explanation of your processes and IT environment over and over again. That costs time, puts pressure on your organisation and regularly leads to confusion, because every accountant takes a slightly different angle. On top of that, not having an ISAE 3402 report can be a barrier in tenders or with larger clients who want to control their risks ever more tightly.

What an ISAE 3402 report brings your organisation

An ISAE 3402 report gives a structured, independent picture of the internal control within your organisation, aimed specifically at the processes that are relevant to your clients’ annual accounts. The report describes your services, the associated processes, the control objectives and the controls you carry out. The auditor then gives an opinion on the design and existence of those controls and, in the case of Type II, on their operating effectiveness over a period.

For your clients and their accountant this is the central reference document. One report drawn up in line with an internationally recognised standard. You show that your control is mature, that you know and address the risks, and that you report transparently on findings. That strengthens their confidence!

How we guide your organisation to an ISAE 3402 report

We start by mapping out your service delivery precisely: which processes do you carry out for clients, which systems do you use, which locations are involved and which parts are relevant to the annual accounts? Together we determine the scope of the ISAE 3402 process, so that the report matches the information needs of your clients and their accountants without becoming unnecessarily complex.

We then compare your current processes and measures with what is needed for a solid ISAE 3402 report. Think of process descriptions, key controls, segregation of duties, IT general controls, incident and change management, and monitoring. We translate the outcomes into a concrete improvement plan with clear priorities, so that you can work in a targeted way on strengthening and documenting your internal control.

Once the basics are in place, we guide you towards the first report. We help you draw up the system and process description, tighten up control activities and record evidence. We then carry out the ISAE 3402 audit (Type I or Type II, depending on your situation and what your clients ask for) and draw up the report. Finally, we look together at how you can secure the annual ISAE 3402 cycle efficiently, so that the report does not remain a one-off project but becomes a permanent part of your quality and control framework.