Key Facts
- Regulator
- International Auditing and Assurance Standards Board (IAASB)
- Latest version
- ISAE 3000 (Revised)
- Effective
- 9 December 2013
- Official text
- www.iaasb.org ↗
What is ISAE 3000?
ISAE 3000 (Revised) is the international standard for assurance engagements other than audits or reviews of historical financial information. The International Auditing and Assurance Standards Board (IAASB) issues it. It applies to practitioners who carry out and report on such engagements, and so to organisations that commission their assurance reports.
Its full title is ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information. Audits and reviews of historical financial information fall under the ISAs and ISREs instead, so ISAE 3000 is the general standard for everything else a practitioner is asked to give assurance on.
An ISAE 3000 report is the assurance report a practitioner issues under the standard. ISAE 3000 (Revised) is effective for assurance reports dated on or after 15 December 2015, and the IAASB publication page is where the current text is published.
Why it matters
A buyer, regulator or board asks for assurance from someone independent of you. Before anyone reads the conclusion, the question is which standard the practitioner worked to.
An assurance report is only as credible as the standard behind it.
The subjects vary widely. The standard's own examples include a statement of compliance with a law or regulation and an evaluation of value for money.
Searches for ISAE 3000 vs SOC 2 treat them as rivals. The difference is the standard behind the report: a SOC 2 is an examination under the AICPA's US attestation standards, while an ISAE 3000 report applies the international standard and can be issued against criteria such as the AICPA Trust Services Criteria. That report is not a SOC 2, so check which one the customer names. The ISAE 3000 vs SOC 2 comparison covers when each one satisfies a buyer.
Who it applies to
ISAE 3000 is written for practitioners: the professionals who carry out assurance engagements and sign the report. Organisations meet it from the other side, as the party that commissions the engagement and receives the report.
The obligation depends on where you are. ISAE 3000 is a professional standard, not a statute. In the UK, ISAE (UK) 3000 is mandatory for public interest assurance engagements the FRC specifies, and voluntary for other engagements unless an FRC subject-matter standard applies.
ISAE 3000 does not list security controls; it governs how assurance is carried out and reported. An ISO 27001 certificate shows a management system meets a standard, while an ISAE 3000 report gives a practitioner's conclusion on one subject matter against stated criteria, so holding one does not give you the other.
The UK position
In the UK the Financial Reporting Council (FRC) issues ISAE (UK) 3000, which adopts the IAASB text with UK additions. The current edition, ISAE (UK) 3000 (Revised September 2026), was published on 23 September 2026 and is effective for assurance reports dated on or after 15 December 2026. The FRC's assurance standards page also lists standards that take over for particular subject matter:
| FRC standard | Relevance |
|---|---|
| ISAE (UK) 3000 (Revised September 2026) | UK adoption of ISAE 3000. Mandatory for FRC-specified public interest assurance engagements and voluntary otherwise |
| Client Asset Assurance Standard (CASS) | Applies instead of ISAE (UK) 3000 for client assets assurance given to the Financial Conduct Authority |
| Standards for Investment Reporting (SIRs) | Subject-matter-specific standards for reporting accountants on investment circulars |
| ISSA (UK) 5000 | Sustainability assurance engagements are carved out of ISAE (UK) 3000 and handled by this standard |
A UK firm usually meets ISAE 3000 when a customer, regulator or board wants independent assurance on something other than its financial statements, such as its controls or its compliance with a regulation. If the engagement is client assets assurance for the FCA, CASS applies instead.
Key requirements
ISAE 3000 sets out how a practitioner accepts, performs and reports an assurance engagement. These are the parts a firm commissioning one will see in the engagement letter and the report:
- Three parties. Every engagement has a responsible party, the practitioner and the intended users. The firm that commissions the work is often the responsible party too.
- Suitable criteria. The subject matter is measured against criteria that are relevant, complete, reliable, neutral and understandable, and the intended users must be able to see them.
- Engagement type. In an attestation engagement another party measures the subject matter and the practitioner reports on that result. In a direct engagement the practitioner does the measuring.
- Level of assurance. The practitioner obtains reasonable assurance or limited assurance. Limited assurance rests on less work, though it must still be meaningful to the intended users.
- Ethics and quality. The practitioner follows independence and ethics rules and works in a firm with quality management to the level the standard sets.
- Written report. The engagement ends in a written report that states the level of assurance, the criteria, the conclusion and its basis.
If the engagement letter doesn't name a standard, ask which one it works to.
Other assurance standards named alongside ISAE 3000
When the IAASB revised ISAE 3000, it also amended ISAE 3402 (controls at a service organisation), ISAE 3410 (greenhouse gas statements) and ISAE 3420 (pro forma financial information in a prospectus). These subject-matter-specific standards are applied in addition to ISAE 3000, not instead of it. The FRC has not adopted them, but UK practitioners may follow them voluntarily unless an FRC standard covers the same subject matter.
Frequently asked questions
An ISAE 3000 report is titled as an independent assurance report and names its addressee. It identifies the level of assurance, the subject matter and the applicable criteria. It sets out the responsibilities of each party, states that the engagement followed ISAE 3000, and gives the practitioner's conclusion and its basis. Read the criteria first: they define what the report covers.
ISAE 3402 is the IAASB's standard for assurance reports on controls at a service organisation. It is applied in addition to ISAE 3000, not as a replacement for it. ISAE 3402 is usually compared with SOC 1 rather than SOC 2. The FRC has not adopted ISAE 3402, so UK practitioners who report under it do so voluntarily.
No. ISAE 3000 governs assurance engagements, so what you receive is a dated assurance report from a practitioner, not a certificate. An ISAE 3000 report gives one conclusion on one subject matter against named criteria. If a customer asks for ISAE 3000 certification, ask which subject matter and which criteria they want assured.
No. The two differ in who can sign the report. A SOC 2 is an examination under AICPA attestation standards and is signed by a licensed CPA firm. An ISAE 3000 report can be signed by a practitioner whose firm meets the standard's ethics and quality management requirements, which includes UK firms. Check which one your customer's request names.
Only for some engagements. ISAE (UK) 3000 covers the public interest assurance engagements the FRC specifies, and for those the firm must also meet the FRC's Ethical Standard on integrity, objectivity and independence. For other engagements a UK practitioner may follow ISAE (UK) 3000 voluntarily, unless an FRC standard such as CASS covers the subject matter.