A cloud provider headquartered in Europe offers its customers an independent assurance report issued under the international standard for controls at a service organization relevant to user entities' financial reporting. A US customer's auditors ask what this report corresponds to. Which statement is correct?
Select an answer to reveal the explanation.
Short Explanation
Think of ISAE 3402 and SSAE 18 SOC 1 as twins raised in different countries: same job, different passports. Both report on controls relevant to the customer's financial reporting. Don't match it to SOC 2 just because you're dealing with a cloud company.
Full Explanation
ISAE 3402, issued by the International Auditing and Assurance Standards Board, governs assurance reports on controls at a service organization that are relevant to user entities' internal control over financial reporting. In the United States, the corresponding engagement is performed under the AICPA attestation standards, SSAE 18, and reported as SOC 1. The two serve the same purpose, come in Type 1 and Type 2 forms and are relied on by user auditors when a service organization processes transactions that affect financial statements. Equating ISAE 3402 with SOC 2 confuses the subject matter; SOC 2 reports on the trust services criteria such as security and availability, not financial reporting controls. Calling it a general-use seal like SOC 3 is wrong as well, since ISAE 3402 reports are intended for user entities and their auditors, and those auditors routinely rely on them. Describing it as an ISO/IEC 27001 certificate mixes an assurance report with a management system certification; the latter is issued by a certification body after an ISMS audit and has a different scope and form. Exam caveat: a security-focused review of a European provider may also need ISAE 3000 based or SOC 2 style reporting. Operational check: confirm the report's standard, type, period and the control objectives covered before relying on it.