ISAE 3000 — International Standard on Assurance Engagements

Why does it matter?

ISAE 3000 (Revised) lets people who are not responsible for a subject matter rely on an independent conclusion about it, such as a statement on controls or on reported information. It makes that conclusion comparable: the criteria must be suitable, the evidence sufficient and appropriate, and the report must state the level of assurance.

Key benefits include:

• Suitable criteria

The practitioner accepts an engagement only if the criteria are relevant, complete, reliable, neutral and understandable, and will be available to intended users (paragraph 24(b)).

• A stated level of assurance

The report says whether assurance is reasonable, with a positive-form conclusion, or limited, based on whether a matter has come to the practitioner's attention (paragraphs 12(a) and 70(l)).

• Ethics and quality management

Practitioners follow the IESBA Code and belong to a firm that applies ISQM 1, or requirements at least as demanding (paragraphs 3, 20 and 31).

• Evidence over assertion

The practitioner obtains sufficient appropriate evidence, requests written representations and considers materiality (paragraphs 44, 57 and 65).

• Clear modified conclusions

A qualified, adverse or disclaimed conclusion is explained in the report with a description of the matter (paragraphs 70(l)(v) and 75 to 77).

How does it work?

ISAE 3000 (Revised) has requirements for introduction and scope (paragraphs 1 to 9), objectives (10 and 11), definitions (12 and 13), conduct of the engagement (14 to 19), ethics (20), acceptance and continuance (21 to 30), quality management (31 to 36), planning and performing (40 to 47), obtaining evidence (48 to 61), forming the conclusion (65 to 67), the report (68 to 72), modified conclusions (73 to 78) and documentation (80 to 84).

Each engagement is classified on two dimensions. In a reasonable assurance engagement the practitioner reduces engagement risk to an acceptably low level. In a limited assurance engagement the risk is higher but the assurance must still be meaningful (paragraph 12(a)). The conclusion addresses the subject matter information, which is the outcome of measuring the underlying subject matter against the criteria (paragraph 12(x)).

The standard names the parties: the responsible party for the underlying subject matter, the measurer or evaluator, the engaging party and the intended users (paragraph 12). The Appendix sets out their roles and responsibilities.

Key Elements

• Preconditions (paragraphs 22 to 25)

The practitioner confirms roles are suitable, the subject matter is appropriate, criteria are suitable and available, evidence can be obtained, the conclusion will be in a written report, and the engagement has a rational purpose.

• Criteria (paragraphs 12(c) and 24(b)(ii))

The benchmarks used to measure or evaluate the underlying subject matter, which must show relevance, completeness, reliability, neutrality and understandability.

• Evidence and materiality (paragraphs 44 to 61)

The practitioner plans and performs procedures to obtain sufficient appropriate evidence and considers materiality in planning and in evaluating misstatements.

• Written representations (paragraphs 57 to 61)

The practitioner requests confirmation that all relevant information was provided and that the measurement against the criteria reflects all relevant matters.

• The assurance report (paragraphs 68 to 72)

A written report with the elements in paragraph 70, including the level of assurance, applicable criteria, the practitioner's conclusion, signature and date.

• Modified conclusions (paragraphs 73 to 78)

Qualified, adverse or disclaimed conclusions where subject matter information is materially misstated or a scope limitation exists.

What does it cover?

ISAE 3000 (Revised) applies to assurance engagements by practitioners other than audits or reviews of historical financial information, which fall under the ISAs and ISREs, and other than assurance on sustainability information, which the current IAASB Handbook assigns to the ISSAs (paragraphs 1 and 5). It contains requirements for attestation engagements and may also be applied to direct engagements, adapted as needed (paragraph 2). Agreed-upon procedures and compilation engagements are outside it (paragraph 6).

What are its objectives?

ISAE 3000 (Revised) sets three objectives for the practitioner (paragraph 10):

Obtain reasonable or limited assurance, as appropriate, about whether the subject matter information is free from material misstatement.

Express a conclusion through a written report that conveys reasonable or limited assurance and describes the basis for the conclusion.

Communicate further as required by this and any other relevant ISAE. Where assurance cannot be obtained and a qualified conclusion is not enough, the practitioner disclaims a conclusion or withdraws (paragraph 11).

Framework in Context

ISAE 3000 (Revised) is the base standard of the IAASB's assurance series, and ISAE 3402 supplements it for reports on controls at a service organization. In the United States, SOC 1 engagements are performed under AT-C section 320 of the AICPA's SSAE No. 18. ISAE 3410 on greenhouse gas statements is withdrawn effective December 15, 2026, the date ISSA 5000 takes effect for sustainability assurance, and jurisdictions adopt ISSA 5000 on their own timetables. In January 2026 the IAASB issued narrow-scope amendments to align the standard with IESBA provisions on using the work of external experts.

Common Framework Mappings

Organizations map ISAE 3000 to complementary assurance and reporting standards to simplify audit scopes, demonstrate control effectiveness, and support integrated compliance and stakeholder reporting.

Mapped frameworks include:

AA1000 Assurance Standard (AA1000AS)

AICPA SOC 1

AICPA SOC 2

GRI Standards

ISAE 3402

ISAE 3410

ISO/IEC 27001

SSAE No. 18