ISAE 3000 vs SOC 2: can a UK assurance report replace a SOC 2?

A prospect wants your SOC 2 report, and a UK assurance firm has offered an ISAE 3000 report on the same criteria instead. This guide settles the ISAE 3000 vs SOC 2 question for UK founders, COOs and security leads at 25 to 250-person firms.

Use an ISAE 3000 report when the buyer accepts an equivalent; get a SOC 2, or a dual-standard report, when a US buyer names SOC 2 or an AICPA report. An ISAE 3000 report on the Trust Services Criteria tests the same criteria under the international assurance standard and can come from a UK firm, but it is not a SOC 2.

For what SOC 2 is and the five criteria categories, start with our SOC 2 hub.

ISAE 3000 vs SOC 2: what is the difference?

The difference between ISAE 3000 and SOC 2 is the standard behind the report, not the controls. A SOC 2 is an examination under the AICPA's US attestation standards, signed by a licensed CPA firm. An ISAE 3000 report applies the international assurance standard, which a UK practitioner can use against criteria such as the Trust Services Criteria.

ISAE 3000 (Revised) is the IAASB's standard for assurance engagements other than audits or reviews of historical financial information; our ISAE 3000 glossary entry explains the standard itself. SOC 2, in the Journal of Accountancy's summary of the SOC reports, is a report on controls that "uses the trust services criteria", with a type 1 or type 2 option.

The two standards sit close together. ICAEW's assurance glossary describes the AICPA's SSAEs as "broadly equivalent" to the ISAEs, with some exceptions due to the US-specific concept of attestation.

The level-of-assurance row matters most. The FRC's ISAE (UK) 3000 classifies every engagement as either reasonable or limited assurance. A limited assurance report on the same criteria gives a buyer less to rely on, so ask for reasonable assurance.

Is ISAE 3000 just the European name for SOC 2?

No. ISAE 3000 is a general international assurance standard that can be applied to many different subject matters. SOC 2 is one specific AICPA report on controls against the Trust Services Criteria. An ISAE 3000 report can test those same criteria, but it carries a different standard, a different signatory and a different name.

ICAEW calls ISAE 3000 (Revised) "a principles-based standard" that can be applied to a broad range of underlying subject matters. The Trust Services Criteria are one possible set of criteria. The AICPA's Assurance Services Executive Committee sets them for use in attestation or consulting engagements.

The service-organisation standard often confused with SOC 2 is ISAE 3402, which pairs with SOC 1 rather than SOC 2; our SOC 1 guide covers it.

When will an ISAE 3000 report satisfy your customer?

An ISAE 3000 report on the Trust Services Criteria will satisfy your customer when the buyer asks for "SOC 2 or equivalent", or for independent assurance over security controls without naming a standard. That is most common with UK and European buyers, and with buyers whose own assurance teams already work under the international standards.

The triggers are concrete. An ISAE 3000 report is a sound choice when most of these are true:

• Who is asking. A UK or European customer, a UK-regulated firm doing outsourcing due diligence, or a buyer whose procurement team uses international assurance terms.
• What the contract says. The contract or questionnaire asks for "SOC 2 or equivalent", "independent assurance" or "a third-party audit report", and names no standard-setter.
• Your wider plan. You expect to report against more than the Trust Services Criteria later, because ISAE 3000 can cover other suitable criteria too.
• Your auditor. You want a UK practitioner who works under the IAASB or FRC standards you and your buyers already know.

The UK standard covers this kind of report too. ISAE (UK) 3000 applies to public-interest engagements the FRC specifies. Firms may also comply with it voluntarily for other assurance engagements, such as a report on your controls, unless the FRC has issued a standard for that specific subject matter.

A report your buyer has not agreed to accept is an expense, not an asset.

When do you need a SOC 2 report instead?

You need a SOC 2 report when a US buyer's contract, questionnaire or vendor-risk policy names SOC 2, an AICPA report or a licensed CPA firm. Those words describe a specific report from a specific kind of signatory. An ISAE 3000 report on the same criteria does not meet that requirement, however closely the testing matches.

The licensing point is a legal one. On the AICPA's Journal of Accountancy podcast on quick-turn SOC engagements, the speaker explains that SOC engagements "are required under state law to be performed by licensed CPAs". A US buyer that relies on that framework will look for a CPA signature.

Choose a SOC 2 when any of these apply:

• Who is asking. A US enterprise security or procurement team, or a buyer of any nationality whose vendor-risk platform lists SOC 2 as a required document.
• What the contract says. It names SOC 2, SOC 2 Type 2, "an AICPA SOC report" or "a licensed CPA firm".
• Your pipeline. US revenue is a growth target, so one US-recognised report serves the next ten prospects, not just this one.
• Your buyer's own auditors. The buyer's assurance team maps vendor reports to SOC 2 sections, and a different format slows its review.

Fairness cuts both ways here. A SOC 2 is not automatically a stronger test of your controls than a reasonable assurance ISAE 3000 report on the same criteria. It is the report US buyers have built their processes around.

How do you confirm what your buyer will accept?

Confirm what your buyer will accept by asking in writing, before you engage any auditor, which standard and which signing firm their requirement allows. A short email answered by the buyer's security or procurement lead settles the ISAE 3000 vs SOC 2 choice and gives you a record to point back to when the report arrives.

We recommend asking five questions:

1. Will you accept an assurance report under ISAE 3000 (Revised) on the AICPA Trust Services Criteria, or must it be a SOC 2 under the AICPA standards?
2. Must the report be signed by a US-licensed CPA firm?
3. Do you need design only, or design and operating effectiveness over a period, and how long a period?
4. Which Trust Services Criteria categories must be in scope?
5. Do you require reasonable assurance?

If the answer is "SOC 2 or equivalent", ask for that phrase in the contract or the questionnaire response.

A report you have to commission twice was the wrong report the first time.

Can one examination produce both a SOC 2 and an ISAE 3000 report?

One examination can be reported under both the AICPA attestation standards and ISAE 3000, when the firm doing the work can sign a SOC 2. That route suits a UK firm selling to US and European buyers at the same time: one round of testing, one set of evidence, and a report each audience recognises.

The signing firm is the constraint. Only a firm with a US-licensed CPA practice can issue the SOC 2 half, so ask any firm offering a dual-standard report who will sign it and under which licence. Our SOC 2 report guide covers what to check in the finished document.

A dual-standard report is worth considering when:

• you have live US and UK or European deals at the same time;
• a US buyer names SOC 2, and a UK buyer prefers the international standard;
• you want to avoid moving auditor if your buyer mix shifts.

If only one audience matters today, a single report under the matching standard is the simpler choice.

What carries over between ISAE 3000, SOC 2 and ISO 27001?

The controls and evidence carry over between ISAE 3000 and SOC 2, because both reports can test the same Trust Services Criteria. An ISO 27001 management system carries over too: its risk assessment, policies and running controls supply much of the evidence either report tests. What does not carry over is the report itself.

The order we recommend:

1. Build the controls against the Trust Services Criteria. Our Trust Services Criteria guide breaks down what each category asks for.
2. Reuse what ISO 27001 already gives you. Policies, risk records, access reviews and change records from an ISO 27001 management system serve both reports.
3. Confirm acceptance in writing. Do this before you choose the standard, not after.
4. Commission the report your buyers named. ISAE 3000, SOC 2, or both from one examination.

Switching standards later costs a new engagement, but none of the controls work is lost.

Frequently asked questions