---
title: "ISAE 3000 vs SOC 2: can a UK assurance report replace a SOC 2?"
canonical: https://www.grcmana.io/vault/soc-2/soc-2-vs-isae-3000
published: 2026-10-21
updated: 2026-10-23
author: "Harry West"
framework: "SOC 2"
control: "Guide ISAE 3000 vs SOC 2: can a UK assurance report replace a SOC 2?"
journeyStage: fundamentals
---

# ISAE 3000 vs SOC 2: can a UK assurance report replace a SOC 2?

## Key takeaways

An ISAE 3000 report on the AICPA Trust Services Criteria tests the same criteria as a SOC 2 under the international assurance standard, and a UK firm can issue it, but it is not a SOC 2. It suits buyers who accept "SOC 2 or equivalent", while a US buyer that names SOC 2, an AICPA report or a licensed CPA firm needs a SOC 2. Confirm which standard and signing firm the buyer accepts, in writing, before you engage anyone.

- **ISAE 3000 (Revised)** — The IAASB's international standard for assurance engagements other than audits or reviews of historical financial information. A UK practitioner can apply it to controls against suitable criteria.
- **ISAE (UK) 3000** — The FRC's UK version of the standard. It covers public-interest engagements the FRC specifies, and firms may comply with it voluntarily for other assurance engagements, such as reports on controls.
- **Reasonable or limited assurance** — ISAE 3000 classifies every engagement as reasonable assurance, giving an opinion, or limited assurance, giving a lighter conclusion. A buyer relying on your controls should ask for reasonable assurance.
- **Who signs a SOC 2** — A SOC 2 is an attestation examination under AICPA standards. The AICPA's Journal of Accountancy explains that SOC engagements are required under US state law to be performed by licensed CPAs.

A prospect wants your SOC 2 report, and a UK assurance firm has offered an ISAE 3000 report on the same criteria instead. This guide settles the ISAE 3000 vs SOC 2 question for UK founders, COOs and security leads at 25 to 250-person firms.

Use an ISAE 3000 report when the buyer accepts an equivalent; get a SOC 2, or a dual-standard report, when a US buyer names SOC 2 or an AICPA report. An ISAE 3000 report on the Trust Services Criteria tests the same criteria under the international assurance standard and can come from a UK firm, but it is not a SOC 2.

For what SOC 2 is and the five criteria categories, start with our [SOC 2 hub](https://www.grcmana.io/vault/soc-2).

## ISAE 3000 vs SOC 2: what is the difference?

The difference between ISAE 3000 and SOC 2 is the standard behind the report, not the controls. A SOC 2 is an examination under the AICPA's US attestation standards, signed by a licensed CPA firm. An ISAE 3000 report applies the international assurance standard, which a UK practitioner can use against criteria such as the Trust Services Criteria.

ISAE 3000 (Revised) is the IAASB's standard for [assurance engagements other than audits or reviews of historical financial information](https://www.iaasb.org/publications/international-standard-assurance-engagements-isae-3000-revised-assurance-engagements-other-audits-or); our [ISAE 3000 glossary entry](https://www.grcmana.io/vault/isae-3000) explains the standard itself. SOC 2, in the [Journal of Accountancy's summary of the SOC reports](https://www.journalofaccountancy.com/newsletters/2016/jun/3-face-of-soc/), is a report on controls that "uses the trust services criteria", with a type 1 or type 2 option.

| Compared on | SOC 2 | ISAE 3000 report on the Trust Services Criteria |
| --- | --- | --- |
| Standard-setter and standard | AICPA attestation standards (SSAEs) | IAASB ISAE 3000 (Revised); in the UK, the FRC also issues ISAE (UK) 3000 |
| Who can issue it | A licensed CPA firm | A practitioner whose firm meets ISAE 3000's quality management and ethical requirements |
| Criteria tested | The AICPA Trust Services Criteria | Whatever suitable criteria the engagement names; here, the Trust Services Criteria |
| Type 1 and Type 2 equivalents | Type 1 (design at a date) and Type 2 (adds operating effectiveness over a period) | No named types; the scope agreed with the practitioner sets design only, or design plus operation over a period |
| Level of assurance | An examination, giving an opinion | Reasonable assurance (an opinion) or limited assurance (a lighter conclusion), so check which |
| What the report is called | A SOC 2 Type 1 or Type 2 report | An independent assurance report under ISAE 3000; never a SOC 2 |
| Who typically accepts it | Buyers who ask for SOC 2 by name, most often in the US | Buyers who ask for "SOC 2 or equivalent", most often in the UK and Europe |
| The UK position | A US standard; no UK standard-setter issues or adopts it | The FRC publishes ISAE (UK) 3000; firms can also report under the IAASB's ISAE 3000 (Revised) |

The two standards sit close together. ICAEW's [assurance glossary](https://www.icaew.com/technical/audit-and-assurance/assurance/what-is-assurance/assurance-glossary) describes the AICPA's SSAEs as "broadly equivalent" to the ISAEs, with some exceptions due to the US-specific concept of attestation.

The level-of-assurance row matters most. The FRC's [ISAE (UK) 3000](https://www.frc.org.uk/library/standards-codes-policy/audit-assurance-and-ethics/assurance-standards/) classifies every engagement as either reasonable or limited assurance. A limited assurance report on the same criteria gives a buyer less to rely on, so ask for reasonable assurance.

## Is ISAE 3000 just the European name for SOC 2?

No. ISAE 3000 is a general international assurance standard that can be applied to many different subject matters. SOC 2 is one specific AICPA report on controls against the Trust Services Criteria. An ISAE 3000 report can test those same criteria, but it carries a different standard, a different signatory and a different name.

ICAEW calls ISAE 3000 (Revised) "a principles-based standard" that can be [applied to a broad range of underlying subject matters](https://www.icaew.com/technical/audit-and-assurance/assurance/standards-and-guidance). The Trust Services Criteria are one possible set of criteria. The AICPA's Assurance Services Executive Committee sets them [for use in attestation or consulting engagements](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022).

The service-organisation standard often confused with SOC 2 is ISAE 3402, which pairs with SOC 1 rather than SOC 2; our [SOC 1 guide](https://www.grcmana.io/vault/soc-1) covers it.

## When will an ISAE 3000 report satisfy your customer?

An ISAE 3000 report on the Trust Services Criteria will satisfy your customer when the buyer asks for "SOC 2 or equivalent", or for independent assurance over security controls without naming a standard. That is most common with UK and European buyers, and with buyers whose own assurance teams already work under the international standards.

The triggers are concrete. An ISAE 3000 report is a sound choice when most of these are true:

- **Who is asking.** A UK or European customer, a UK-regulated firm doing outsourcing due diligence, or a buyer whose procurement team uses international assurance terms.
- **What the contract says.** The contract or questionnaire asks for "SOC 2 or equivalent", "independent assurance" or "a third-party audit report", and names no standard-setter.
- **Your wider plan.** You expect to report against more than the Trust Services Criteria later, because ISAE 3000 can cover other suitable criteria too.
- **Your auditor.** You want a UK practitioner who works under the IAASB or FRC standards you and your buyers already know.

The UK standard covers this kind of report too. ISAE (UK) 3000 applies to public-interest engagements the FRC specifies. Firms may also comply with it voluntarily for other assurance engagements, such as a report on your controls, unless the FRC has issued a standard for that specific subject matter.

A report your buyer has not agreed to accept is an expense, not an asset.

## When do you need a SOC 2 report instead?

You need a SOC 2 report when a US buyer's contract, questionnaire or vendor-risk policy names SOC 2, an AICPA report or a licensed CPA firm. Those words describe a specific report from a specific kind of signatory. An ISAE 3000 report on the same criteria does not meet that requirement, however closely the testing matches.

The licensing point is a legal one. On the AICPA's Journal of Accountancy podcast on [quick-turn SOC engagements](https://www.journalofaccountancy.com/podcast/2026/apr/the-risks-of-quick%E2%80%91turn-soc-engagements-and-what-cpas-should-know/), the speaker explains that SOC engagements "are required under state law to be performed by licensed CPAs". A US buyer that relies on that framework will look for a CPA signature.

Choose a SOC 2 when any of these apply:

- **Who is asking.** A US enterprise security or procurement team, or a buyer of any nationality whose vendor-risk platform lists SOC 2 as a required document.
- **What the contract says.** It names SOC 2, SOC 2 Type 2, "an AICPA SOC report" or "a licensed CPA firm".
- **Your pipeline.** US revenue is a growth target, so one US-recognised report serves the next ten prospects, not just this one.
- **Your buyer's own auditors.** The buyer's assurance team maps vendor reports to SOC 2 sections, and a different format slows its review.

Fairness cuts both ways here. A SOC 2 is not automatically a stronger test of your controls than a reasonable assurance ISAE 3000 report on the same criteria. It is the report US buyers have built their processes around.

## How do you confirm what your buyer will accept?

Confirm what your buyer will accept by asking in writing, before you engage any auditor, which standard and which signing firm their requirement allows. A short email answered by the buyer's security or procurement lead settles the ISAE 3000 vs SOC 2 choice and gives you a record to point back to when the report arrives.

We recommend asking five questions:

1. Will you accept an assurance report under ISAE 3000 (Revised) on the AICPA Trust Services Criteria, or must it be a SOC 2 under the AICPA standards?
2. Must the report be signed by a US-licensed CPA firm?
3. Do you need design only, or design and operating effectiveness over a period, and how long a period?
4. Which Trust Services Criteria categories must be in scope?
5. Do you require reasonable assurance?

If the answer is "SOC 2 or equivalent", ask for that phrase in the contract or the questionnaire response.

A report you have to commission twice was the wrong report the first time.

## Can one examination produce both a SOC 2 and an ISAE 3000 report?

One examination can be reported under both the AICPA attestation standards and ISAE 3000, when the firm doing the work can sign a SOC 2. That route suits a UK firm selling to US and European buyers at the same time: one round of testing, one set of evidence, and a report each audience recognises.

The signing firm is the constraint. Only a firm with a US-licensed CPA practice can issue the SOC 2 half, so ask any firm offering a dual-standard report who will sign it and under which licence. Our [SOC 2 report guide](https://www.grcmana.io/vault/soc-2/report) covers what to check in the finished document.

A dual-standard report is worth considering when:

- you have live US and UK or European deals at the same time;
- a US buyer names SOC 2, and a UK buyer prefers the international standard;
- you want to avoid moving auditor if your buyer mix shifts.

If only one audience matters today, a single report under the matching standard is the simpler choice.

## What carries over between ISAE 3000, SOC 2 and ISO 27001?

The controls and evidence carry over between ISAE 3000 and SOC 2, because both reports can test the same Trust Services Criteria. An ISO 27001 management system carries over too: its risk assessment, policies and running controls supply much of the evidence either report tests. What does not carry over is the report itself.

The order we recommend:

1. **Build the controls against the Trust Services Criteria.** Our [Trust Services Criteria guide](https://www.grcmana.io/vault/soc-2/trust-services-criteria) breaks down what each category asks for.
2. **Reuse what ISO 27001 already gives you.** Policies, risk records, access reviews and change records from an [ISO 27001](https://www.grcmana.io/vault/iso-27001) management system serve both reports.
3. **Confirm acceptance in writing.** Do this before you choose the standard, not after.
4. **Commission the report your buyers named.** ISAE 3000, SOC 2, or both from one examination.

Switching standards later costs a new engagement, but none of the controls work is lost.

## Frequently asked questions

### Is an ISAE 3000 report a certification?

No. An ISAE 3000 report is an assurance report: a practitioner's conclusion on subject matter measured against stated criteria. A SOC 2 is not a certification either. Neither report leads to a certificate, and neither should be described as one to a buyer.

### Can a UK firm issue a SOC 2 report?

Only a licensed CPA firm can sign a SOC 2 report. Some UK practices work with, or include, a US-licensed CPA firm that signs. Ask who will sign, under which licence, before you engage.

### Does ISAE 3000 have a Type 2 report?

ISAE 3000 does not use the Type 1 and Type 2 labels. You agree the scope with the practitioner instead: design only, or design plus operating effectiveness over a stated period. Ask for the period-based scope if your buyer expects the equivalent of a SOC 2 Type 2.

### Will a US customer accept an ISAE 3000 report?

Some will, especially where the contract asks for "SOC 2 or equivalent". Others will not, because their vendor-risk policy names SOC 2 or a licensed CPA firm. The only reliable answer is the buyer's own, in writing.