The audit file that
survives the review.
Skip the 30-hour blank-Excel scramble. Open a structured engagement file where every judgment call is prompted, every paragraph reference is verified, and every tab cross-references the next, ready for partner review on day one.
You got assigned your first ISAE 3402.
You opened a blank Excel.
When the engagement lands, most seniors reverse-engineer the standard and build the file from scratch, under time pressure, with no reference point for what defensible actually looks like.
The AFM's 2025 fraud risk investigation reviewed 32 ISAE 3402 files across 13 Dutch firms. 23 had insufficient evidence. They called it the third and final warning.
Clustered sampling. Inquiry alone. No pre-defined deviation criteria. IPE not tested. Design confused with OE. These aren't obscure errors. They're in the standard. They keep appearing because the right framework doesn't exist in the file.
That's the realistic estimate for a senior building a defensible 28-column control matrix, risk assessment, testing protocol, and gap analysis from first principles. At your billing rate, that's €2,400–6,000 of your time.
There are surface-level explainers everywhere. There are no working templates that embed the judgment calls, paragraph references, and cross-references that make a file survive a regulatory inspection.
Files reviewed across 13 Dutch audit firms found insufficient evidence, specifically around IPE testing and the reliance on inquiry as a standalone procedure. This is the regulatory environment your next ISAE 3402 file will be reviewed against.
What changes when the file is already built.
Seven tabs. Everything connected.
Seven tabs, one connected system. Open any tab and the cross-references tell you exactly where the inputs came from and where the outputs go.
Hand the file to a junior and they can start working immediately. A plain-language setup guide walks through the entire structure in 10–15 minutes. No onboarding call, no instruction manual.
Know exactly where you stand before partner review, without manually tallying anything. Control counts, testing status, open gaps, and sign-off progress update automatically as you work through the other tabs.
Stop guessing what your reviewer will challenge. Amber-highlighted judgment columns flag the exact IPE and Key/Non-Key decisions that trigger review notes, with judgment prompts explaining what a defensible answer looks like.
Document the risk rationale once and have it flow into your testing plan automatically. Three-layer assessment with service-organisation-specific risk factors already embedded. No more scrambling to justify your selections at review.
Avoid the five most common testing errors before fieldwork begins. A built-in planning block forces the right decisions up front, with corrected paragraph references (sampling is Para. 24–29, not the A47–A54 most files cite).
Catch qualification triggers before the partner does. A nine-item sign-off checklist must clear before the report can be dated, with severity ratings tied directly to the Para. 53–55 opinion thresholds that determine whether a finding qualifies.
Stop drafting the gap period letter from scratch every engagement. A ready-to-use management representation letter covers the period between your report date and the user entity's year-end. Just fill in the dates and entity details.
Give the user entity clear, documented testing responsibilities from day one. Six pre-populated CUECs covering access management, payroll, change management, journal entries, treasury, and incident reporting, ready to expand for your engagement.
This is what the control matrix actually looks like.
Real column headers. Real judgment prompts. Real example controls. Not a mockup. This is the structure you open on day one.
| Control ID | Objective | Control Description | Type | Key / Non-Key | IPE | Risk ID Link |
|---|---|---|---|---|---|---|
| CTL-01 | Access Management | Quarterly user access reviews performed by IT manager with sign-off | Detective | Key: single control addressing CO-01 with no compensating control | Yes, relies on system-generated user listing | RA-01 |
| CTL-02 | Change Management | All production changes require documented approval before deployment | Preventive | Key: no alternative control exists for unauthorized changes | No | RA-03 |
| CTL-03 | Processing Integrity | Automated reconciliation of input and output transaction counts daily | Detective | Non-Key: compensating control CTL-04 addresses same risk | Yes, relies on system-generated reconciliation report | RA-05 |
Start with the free control matrix
The 28-column structure, all headers, judgment prompts, and dropdown classifications: no pre-populated examples, no connected tabs. Download this first if you want to see the foundation before committing to the full workbook.
Built around what regulators actually check.
SAMPLE JUDGMENT PROMPTS
Prompt 12 · Tab 2: Risk Assessment
"Has management identified all sub-service organisations and documented the nature of services each provides to user entities?"
Reference: ISAE 3402.A14
Prompt 47 · Tab 4: Control Testing
"For each key control, have you documented the nature, timing, and extent of testing performed, including the rationale for sample sizes selected?"
Reference: ISAE 3402.33(b)
Prompt 78 · Tab 6: Deviation Reporting
"Where deviations were identified, have you assessed whether they represent isolated incidents or systemic control failures, and documented the basis for that conclusion?"
Reference: ISAE 3402.40-41
3 of 95 judgment prompts. The full workbook covers scoping through reporting.
HOW CIFERI COMPARES
| Free (IFAC/ICAI) | ciferi | Enterprise (Mercia/CaseWare) | |
|---|---|---|---|
| Price | Free | €249 one-time | €1,000–3,000/year |
| Format | PDF guidance | Editable Excel + PDF | Locked in platform |
| ISA coverage | General guidance | Paragraph-level mapping | Full methodology |
| Software needed | None | Excel only | Proprietary platform |
| Updates | Sporadic | Free when standards change | Included in subscription |
The alternative is more expensive than you think.
The real comparison isn't €249 versus a free template. It's €249 versus the cost of building this yourself, or the cost of a finding.
The 8-Hour Promise
Use the workbook on your next engagement. If you haven't saved at least 8 hours compared to building the file from scratch, email [email protected] within 60 days and get a full refund. No questions asked. The workbook either saves you time or it costs you nothing.
ISAE 3402 Audit Workbook
One-time payment · VAT included · Instant download
Less than €35 per engagement when used on 7 audits.
Forward to your quality partner →
60-day guarantee: if you haven't saved 8 hours, email us and we'll refund you in full.
Built for auditors who are actually doing this work.
Running ISAE 3402 engagements without a firm methodology team. Need a file structure that passes quality review without building one from scratch.
At BDO, Grant Thornton, Mazars, Baker Tilly, or similar. Assigned the engagement and looking for a reference point for what defensible actually looks like.
Preparing for an external ISAE 3402 review who want to see exactly what the auditor will check and fix gaps before they arrive.
Going through their first SOC 1 / ISAE 3402 engagement and need to understand the deliverable their auditor should be producing.
This workbook is not for you if:
- Your firm already has a proprietary ISAE 3402 methodology (Big 4 firms, for example)
- You need a training course. This workbook assumes you understand the standard
- You only need a single checklist, not a full engagement file (see our free checklists instead)
The answer is yes.
Is this based on current ISAE 3402 requirements?
Every tab maps to specific ISAE 3402 paragraphs. Updated for current IAASB guidance.
Will it work for my firm's methodology?
Fully customisable. Adapt every prompt, add your firm's branding, modify the structure to match your approach.
Can I use it on multiple engagements?
Unlimited use. One purchase, every engagement. No per-client or per-year licensing.
Is it up to date?
Current as of March 2026. Free updates when standards change — you will receive the updated file by email.
Does it work for SOC 1 engagements?
Yes. ISAE 3402 and SOC 1 share the same underlying framework. The workbook covers both.
Will my data be secure?
It is an Excel file on your own computer. No cloud upload, no third-party access, no account required.
Can I try before I buy?
The 60-day guarantee means you can use it on a real engagement. If it does not save you time, you get a full refund.
Questions
Anyone responsible for an ISAE 3402 or SOC 1 engagement who needs a defensible file structure without building one from scratch. Sole practitioners, mid-tier seniors (BDO, Grant Thornton, Mazars, Baker Tilly), internal auditors preparing for external review, and CFOs going through their first engagement. Not for practitioners who've never opened the standard.
10–15 minutes to input your service organization's name, audit period, and engagement type across the tabs. The example rows and judgment prompts are already populated. You're adapting a working file, not filling a blank one.
Yes. References include ISAE 3402 (current), ISA 530 applied by analogy, AT-C 205.36 for IPE, ISQM 2 for EQR triggers, ISA 402 for the bridge letter, and AFM and PCAOB findings through 2025 including the 2024 PCAOB Staff Alert on IPE deficiencies.
Yes. The control matrix, testing protocol, and gap analysis translate directly. The structural requirements under SSAE 18 (the US equivalent) are substantively the same. The bridge letter explicitly covers ISAE 3402 / SSAE 18. Where US-specific references are relevant (AT-C 205) they're included.
Yes, for your own engagements. The license covers use across your client engagements. It doesn't cover redistribution or resale as a firm-wide licensed template. Contact ciferi.com if you need firm licensing.
You get free updates. When ISAE 3402 is revised or when new AFM/PCAOB guidance materially affects the deficiency patterns in the file, the workbook is updated and existing buyers get the new version at no charge.
We offer a 60-day results guarantee. If you've used the workbook and haven't saved at least 8 hours on your engagement, email [email protected] within 60 days of purchase and we'll refund you in full. No questions asked. See our full refund policy.
Deep dives on ISAE 3402
You may also need
ISA 240 Fraud Risk Assessment Toolkit
Fraud brainstorming agenda, risk matrix, journal entry testing templates, and management override procedures.
View toolkitNot ready to buy?
Free Audit Checklists
8 ISA inspection readiness scorecards. Score your file against regulator findings in 5 minutes.
See free checklists