ISAE Type II

The International Standard on Assurance Engagements (ISAE) provides assurance about the quality of the internal control measures a service organization applies when delivering its services. Within ISAE 3402, there are two types of reports: type 1 and type 2.

• Type 1: focuses on the design and existence of the control measures, i.e. the description and implementation of the intended controls.

• Type 2: in addition to the design, also examines the effective operation of the control measures over a certain period.

Under the law (Art. 4:16 Wft), financial institutions are required to demonstrate, in the case of outsourcing, that processes are adequately controlled. This means a bank, insurer, or other financial institution always requires a Service Organisation Control (SOC) report from its suppliers before they're allowed to deliver services.

The ISAE 3402 report serves as evidence that all outsourced processes at the service organization are actually effectively controlled.