ISAE 3000 (Revised) — Assurance Engagements Other Than Audits or Reviews: Complete Guide

Key Takeaways

ISAE 3000 (Revised) is the foundational standard for the entire non-audit assurance market — from service organisation controls to regulatory compliance to sustainability reporting.
Its principles-based approach enables application across an enormous range of subject matters, while the two-level assurance model (reasonable and limited) provides flexibility for different stakeholder needs.
For European auditors, ISAE 3000 competence is essential as assurance demands expand through CSRD, regulatory requirements, and commercial needs.
While ISSA 5000 will take over the sustainability assurance space from December 2026, ISAE 3000 remains the governing standard for service organisations (ISAE 3402), compliance assurance, KPI assurance, and every other non-sustainability, non-financial-statement assurance engagement.
Building deep ISAE 3000 capability is one of the strongest strategic investments a mid-tier European firm can make.

Why ISAE 3000 Matters

The demand for independent assurance extends far beyond financial statement audits. Stakeholders want assurance on internal controls at service organisations, sustainability reports, regulatory compliance, key performance indicators, prospectus information, and countless other subject matters. ISAE 3000 (Revised) is the overarching standard that governs all these assurance engagements — any engagement that provides assurance but is not an audit or review of historical financial information falls under its umbrella.

For European audit firms, ISAE 3000 has become strategically critical. The Corporate Sustainability Reporting Directive (CSRD) mandates limited assurance on sustainability statements from financial year 2024, and the vast majority of these engagements are currently performed under ISAE 3000 (Revised). Service organisation controls (SOC/ISAE 3402) reports, compliance certifications, and regulatory attestations all depend on ISAE 3000's framework. For non-Big 4 firms seeking to grow beyond traditional audit, mastering ISAE 3000 is not optional — it is the gateway to the expanding assurance market.

Scope and Fundamental Concepts

ISAE 3000 (Revised), effective for assurance reports dated on or after 15 December 2015, is a principles-based standard that applies to all assurance engagements other than audits (ISAs) or reviews (ISREs) of historical financial information. It serves as both:

A standalone standard for engagements where no subject-specific ISAE exists
A foundation standard that applies alongside subject-specific ISAEs (such as ISAE 3402 for service organisations and ISAE 3410 for greenhouse gas statements)

The Assurance Framework

Every ISAE 3000 engagement involves a three-party relationship:

Party	Role	Example
Practitioner	Performs procedures and provides the assurance conclusion	The audit firm engaged to provide the report
Responsible party	Responsible for the underlying subject matter	The entity that operates the internal controls being assured
Intended users	The parties for whom the assurance report is prepared	Customers relying on a service organisation's controls report

Sometimes the responsible party is also the engaging party (who contracts the practitioner) and may overlap with the intended users. In other structures, a regulator (intended user) may require an entity (responsible party) to engage an auditor (practitioner) to provide assurance on compliance.

Attestation vs. Direct Engagements

Attestation engagements: The responsible party (or a measurer/evaluator) measures or evaluates the underlying subject matter against criteria and presents the resulting "subject matter information" as an assertion. The practitioner then provides assurance on that assertion. This is the most common type — for example, management prepares a description of its internal controls (the assertion), and the practitioner provides assurance on whether that description is fairly stated.

Direct engagements: The practitioner directly measures or evaluates the underlying subject matter against criteria and presents the resulting information in the assurance report. The practitioner is both the measurer/evaluator and the assurer. These are less common but arise in specific regulatory contexts.

Two Levels of Assurance

A critical feature of ISAE 3000 is the distinction between two assurance levels:

Reasonable Assurance

Objective: Reduce engagement risk to an acceptably low level as the basis for a positive form of conclusion
Work effort: Extensive procedures including understanding the entity, risk assessment, response procedures (tests of controls, substantive procedures), evaluation of evidence
Conclusion wording (positive form): "In our opinion, [the subject matter information] is prepared, in all material respects, in accordance with [criteria]"
Comparable to: The level of assurance in a financial statement audit under the ISAs
Engagement risk: Acceptably low (same concept as audit risk in ISAs)

Limited Assurance

Objective: Reduce engagement risk to a level acceptable for a limited assurance engagement as the basis for a negative form of conclusion
Work effort: Less than reasonable assurance but more than merely nominal — primarily inquiry and analytical procedures, with additional procedures performed as the practitioner considers necessary
Conclusion wording (negative form): "Based on our procedures, nothing has come to our attention that causes us to believe that [the subject matter information] is not prepared, in all material respects, in accordance with [criteria]"
Comparable to: More than a review engagement (ISRE 2400) but less than a full audit
Engagement risk: Acceptable for the circumstances but higher than reasonable assurance

"Limited" does not mean "light"

A common misunderstanding is that limited assurance requires minimal work. The standard explicitly states that the work effort must be sufficient to provide a meaningful level of assurance. Procedures must go beyond inquiry alone — analytical procedures, observation, and testing may all be necessary. The practitioner must exercise professional judgment about what procedures are needed to achieve the limited assurance objective. Regulators like the AFM and FRC have criticised practitioners whose limited assurance work was insufficiently rigorous.

Engagement Acceptance and Continuance

The practitioner must satisfy several preconditions before accepting:

Preconditions for Acceptance

Precondition	Requirement
Ethical requirements	The practitioner meets independence and other ethical requirements (IESBA Code or national equivalent)
Quality management	The firm's system of quality management complies with ISQM 1 (or national equivalent)
Competence	The practitioner has competence in the subject matter and assurance skills
Subject matter	The underlying subject matter is appropriate (identifiable, capable of consistent evaluation)
Criteria	The criteria are suitable and available to intended users
Evidence	Sufficient appropriate evidence can be obtained
Conclusion	The practitioner's conclusion will be in a written report in the form appropriate to the engagement
Rational purpose	The engagement has a rational purpose

Criteria Suitability

The criteria against which the subject matter is evaluated must possess five characteristics:

Relevance — contributes to conclusions that assist intended users' decision-making
Completeness — no relevant factors are omitted
Reliability — allows reasonably consistent evaluation
Neutrality — contributes to conclusions that are free from bias
Understandability — contributes to conclusions that are clear and not subject to significantly different interpretations

Criteria may come from laws, regulations, standards (such as the COSO framework for internal controls or ESRS for sustainability), contracts, or may be specifically developed for the engagement.

Scope Limitations at Acceptance

If the engaging party imposes a scope limitation that the practitioner believes will result in a disclaimer, the practitioner must not accept the engagement as an assurance engagement (unless required by law or regulation).

Performing the Engagement

Planning and Risk Assessment

The practitioner must:

Plan the engagement to ensure it is performed effectively
Obtain an understanding of the underlying subject matter and its context
Consider the process used to prepare the subject matter information
Assess the risks of material misstatement (for reasonable assurance) or the risks that the subject matter information is materially misstated (for limited assurance)
Respond to assessed risks by designing and performing procedures

Evidence Gathering

For reasonable assurance, the practitioner designs and performs procedures to obtain sufficient appropriate evidence. This includes:

Understanding the entity and its environment related to the subject matter
Risk assessment procedures
Tests of controls (where the practitioner intends to rely on controls)
Detailed testing of the subject matter information
Analytical procedures
Inquiry, inspection, observation, confirmation, recalculation, reperformance

For limited assurance, the practitioner's procedures are primarily:

Inquiry of the responsible party and others
Analytical procedures
Other procedures as the practitioner considers necessary

The key difference is not the types of procedures available but the nature, timing, and extent. Limited assurance procedures are less extensive and may focus on areas where material misstatements are more likely to arise.

Materiality

The practitioner must consider materiality when:

Planning the engagement and designing procedures
Evaluating whether the subject matter information is free from material misstatement
Forming the conclusion

Materiality for non-financial subject matter requires careful judgment. For a sustainability report, materiality might consider the impact on stakeholder decisions. For internal controls, materiality relates to the significance of control deficiencies. For compliance engagements, materiality may relate to the significance of deviations from requirements.

Using the Work of Others

The practitioner may use the work of:

Another practitioner — A practitioner involved in the engagement at a component or specific location
A practitioner's expert — An individual or organisation with expertise in a field other than assurance
An internal auditor — Subject to evaluation of objectivity and competence (similar to ISA 610)

In all cases, the practitioner retains sole responsibility for the conclusion expressed.

Reporting

Assurance Report Content

The assurance report must include:

Element	Content
Title	Clearly indicates an independent assurance report
Addressee	Appropriate for the intended users
Subject matter	Identification of the subject matter information and underlying subject matter
Criteria	Identification of the applicable criteria
Responsible party	Identification and their responsibility
Practitioner's responsibility	Describing the nature of the engagement (reasonable or limited)
Summary of work	Description of the procedures performed (particularly important for limited assurance, where the nature of procedures affects the reader's understanding)
Conclusion	Positive form (reasonable) or negative form (limited)
Signature, date, address	Standard elements

Modified Conclusions

Circumstance	Reasonable Assurance	Limited Assurance
Material but not pervasive misstatement	Qualified opinion ("except for")	Qualified conclusion ("except for")
Material and pervasive misstatement	Adverse opinion	Adverse conclusion
Material but not pervasive scope limitation	Qualified opinion	Qualified conclusion
Material and pervasive scope limitation	Disclaimer	Disclaimer

The ISAE 3000 Ecosystem — Subject-Specific Standards

ISAE 3000 does not operate in isolation. Several subject-specific standards build on its foundation:

Standard	Subject Matter	ISAE 3000 Relationship
ISAE 3402	Controls at a service organisation	Applies alongside ISAE 3000; Type 1 (design) and Type 2 (effectiveness) reports
ISAE 3410	Greenhouse gas statements	Applies alongside ISAE 3000 (to be withdrawn when ISSA 5000 becomes effective)
ISAE 3420	Pro forma financial information in prospectuses	Applies alongside ISAE 3000
ISSA 5000	Sustainability assurance (effective December 2026)	Standalone — replaces ISAE 3000 for sustainability subject matters

The ISSA 5000 Transition

This is the most significant development affecting ISAE 3000's practical scope:

Current state (2024–2026): CSRD assurance engagements are performed under ISAE 3000 (Revised). As of early 2025, more than 70 CSRD reports across 16 European jurisdictions have been published under ISAE 3000 limited assurance.

From December 2026: ISSA 5000 becomes effective for sustainability assurance engagements. ISSA 5000 is a standalone standard — practitioners applying it do not also need to apply ISAE 3000. However, ISAE 3000 continues to apply for all non-sustainability assurance engagements.

What changes: ISSA 5000 introduces sustainability-specific concepts including double materiality, value chain considerations, qualitative disclosures, and forward-looking information. It was built on ISAE 3000's foundation but adds significant sustainability-specific guidance.

EU dimension: The European Commission invited CEAOB to develop assurance guidelines for the CSRD transition period and to advise on incorporating ISSA 5000 into EU requirements. The EU Omnibus Simplification Package (February 2025) has introduced uncertainty about whether reasonable assurance for ESRS reporting will be required, with the current direction shifting toward assurance guidelines rather than mandated standards.

ISAE 3000 remains essential

Even after ISSA 5000 takes effect, ISAE 3000 remains the governing standard for ISAE 3402 (service organisations), compliance assurance, internal control assurance outside sustainability, and any other non-sustainability assurance engagement. Firms should not neglect ISAE 3000 competence in favour of ISSA 5000 — both are needed.

Common ISAE 3000 Engagement Types

ISAE 3402 — Service organisation controls: Type 1 reports (design and implementation at a point in time) and Type 2 reports (operating effectiveness over a period). These are critical for entities outsourcing IT, payroll, pension administration, or other processes. The client's auditor (user auditor) relies on the service organisation's ISAE 3402 report.

Regulatory compliance certifications: Regulators may require independent assurance that an entity complies with specific rules. Examples include anti-money laundering compliance, data protection compliance, or sector-specific regulations.

Key performance indicator assurance: Entities may seek assurance on reported KPIs (customer satisfaction scores, safety statistics, production metrics) for stakeholder reporting or regulatory purposes.

Internal control assurance: Independent assurance on the effectiveness of internal controls beyond what is required for the financial statement audit, often for governance or regulatory purposes.

Grant compliance assurance: Government agencies or EU institutions may require independent assurance that grant funds were used in accordance with terms and conditions.

European Jurisdiction Implementations

Netherlands

Dutch practice is heavily engaged with ISAE 3000 through several channels. The NBA has published specific standards and guidance (Standaard 3000) aligning with the international standard. ISAE 3402 engagements are particularly prevalent given the Netherlands' role as a major outsourcing and shared services hub — service organisation audits for payroll, pension administration, and IT services are a significant practice area. For CSRD assurance, Dutch firms are performing limited assurance under ISAE 3000 on sustainability statements of large listed companies (first wave from FY 2024), with the AFM monitoring quality. The NBA has issued practice guidance on applying ISAE 3000 to sustainability reporting. For grant compliance, Dutch entities receiving EU structural funds or Rijkssubsidies (government subsidies) frequently require ISAE 3000 assurance on expenditure declarations.

Germany

German implementation follows IDW PS 3000 (equivalent to ISAE 3000). German practice has a strong tradition of Prüfungen nach ISAE 3402 (service organisation audits), particularly for banking and insurance support services. The Institut der Wirtschaftsprüfer (IDW) has developed extensive guidance for specific ISAE 3000 engagement types including Bescheinigungen (certifications) for regulatory compliance, assurance on corporate governance statements, and sustainability assurance under the CSRD. German firms face particular challenges with the CSRD first wave due to the large number of German listed companies subject to the directive. IDW PS 821 provides specific guidance on sustainability assurance, building on ISAE 3000 principles while addressing German regulatory requirements. For Compliance-Prüfungen (compliance audits), IDW PS 980 prescribes a framework for compliance management system audits that interfaces with ISAE 3000.

United Kingdom

The UK has one of the most developed non-audit assurance markets in Europe. ISAE (UK) 3000 incorporates additional UK requirements, particularly for PIEs. The FRC has published Practice Note 10 on audit of financial statements of public sector entities and various technical staff guidance on applying ISAE 3000 to different subject matters. The UK charity sector frequently requires ISAE 3000 engagements for assurance on grant compliance and restricted fund usage. For CSRD, while the UK is not subject to EU requirements, UK-listed subsidiaries of EU groups may require sustainability assurance, and the UK government has signalled its own sustainability reporting requirements. The ICAEW has published extensive guidance on ISAE 3000 engagements. AAF 01/20 (Assurance Reports on Internal Controls of Service Organisations) is the UK's local equivalent to ISAE 3402, operating within the ISAE 3000 framework.

France

French practice under NEP 3000 has adapted ISAE 3000 to the French regulatory environment. The commissaire aux comptes role in France extends beyond financial statement auditing to include various attestations and rapports that fall under ISAE 3000 principles. For CSRD sustainability assurance, French firms and organismes tiers indépendants (OTIs — independent third-party organisations) are performing limited assurance on sustainability statements under ISAE 3000. The French transposition of CSRD through the ordonnance establishes the dual-provider model where either the commissaire aux comptes or an OTI can perform sustainability assurance. ISAE 3402 engagements are growing in France as more entities outsource business processes. The H3C (Haut Conseil du Commissariat aux Comptes) oversees quality for assurance engagements. For specific French requirements like attestations sur le rapport sur le gouvernement d'entreprise (assurance on corporate governance reports), ISAE 3000 provides the framework applied through CNCC guidance.

Relationship with Other Standards

ISAs — ISAE 3000 explicitly excludes engagements governed by ISAs (financial statement audits); however, ISA concepts like materiality, evidence, and risk are adapted for ISAE 3000
ISREs — ISAE 3000 excludes review engagements governed by ISREs
ISAE 3402 — Applies alongside ISAE 3000 for service organisation engagements
ISAE 3410 — Applies alongside ISAE 3000 for GHG statements (to be withdrawn when ISSA 5000 effective)
ISAE 3420 — Applies alongside ISAE 3000 for pro forma financial information
ISSA 5000 — Replaces ISAE 3000 for sustainability assurance from December 2026 (standalone)
ISQM 1 — Quality management requirements apply to the firm performing ISAE 3000 engagements
IESBA Code — Independence and ethical requirements apply with specific provisions for assurance engagements

Frequently Asked Questions

What is the difference between reasonable and limited assurance?

Reasonable assurance provides a positive form of conclusion ("In our opinion...") based on extensive procedures including risk assessment, tests of controls, and detailed testing — comparable to an audit. Limited assurance provides a negative form of conclusion ("Nothing has come to our attention...") based on primarily inquiry and analytical procedures. The work effort for limited assurance is less extensive but must still be sufficient to provide a meaningful level of assurance.

Does ISAE 3000 still apply after ISSA 5000 becomes effective?

Yes. ISSA 5000, effective from December 2026, replaces ISAE 3000 only for sustainability assurance engagements. ISAE 3000 continues to govern all other non-audit assurance engagements including service organisation controls (ISAE 3402), regulatory compliance certifications, KPI assurance, internal control assurance, and grant compliance assurance.

What types of engagements fall under ISAE 3000?

ISAE 3000 covers any assurance engagement that is not an audit or review of historical financial information. Common examples include ISAE 3402 service organisation controls reports, regulatory compliance certifications, key performance indicator assurance, internal control assurance, grant compliance assurance, and currently CSRD sustainability assurance (until ISSA 5000 takes effect).

What are the preconditions for accepting an ISAE 3000 engagement?

The practitioner must satisfy several preconditions: meeting ethical and independence requirements, having a quality management system complying with ISQM 1, possessing competence in the subject matter, confirming the subject matter is appropriate and criteria are suitable, determining that sufficient appropriate evidence can be obtained, ensuring the conclusion will be in a written report, and confirming the engagement has a rational purpose.