%20(12).png)
Do your services impact your clients' financial reporting? If so, you need a SOC 1 report that is reliable for financial statement audits and can withstand scrutiny from your clients' auditors.
Certinova guides you efficiently through the entire process: from the initial readiness assessment and the definition of scope and control objectives to the certified Type 2 report in accordance with ISAE 3402 or IDW PS 951.
Our auditors combine technical expertise with a digital platform that significantly reduces the internal workload for your organization.
Digital workflows and reusable evidence reduce manual effort – especially during re-certification.
Numerous completed audit and assessment projects form the basis of our methodology.
SaaS providers, cloud platforms, IT service providers, and regulated companies rely on Certinova
ISAE 3402 is not a product in itself, but rather the common foundation for several reports. Which one is right for you depends on your clients and their auditors.
.svg)
The standard describes how an independent auditor assesses the description of a service provider's control system as well as the design and, in the case of Type 2, the operating effectiveness of the controls. The focus is on controls relevant to the clients' financial reporting.
.svg)
Type 1 certifies that your controls are appropriately designed as of the audit date. It is the ideal entry point to meet initial client requirements and lay the foundation for a subsequent Type 2 report.
.svg)
SOC 1 is the US counterpart according to the AICPA and is closely integrated with ISAE 3402 in practice. For service providers with international clients, SOC 1 is often the standard format.
Find out more about SOC 1 here.
.svg)
IDW PS 951 is the German auditing standard for the same purpose. It can be aligned with ISAE 3402 so that one report can cover both requirements. For clients in Germany, it is often the first choice.
Find out more about IDW PS 951 here.
We combine professional assessment by experienced auditors with technology-driven processes.
The result: shorter audit cycles, less internal effort for you, and reports that meet your customers' requirements.
Evidence is collected in a structured manner and automatically validated – the professional assessment remains with our auditors.
Submit documents, answer questionnaires, track status—transparent instead of endless email chains.
A clear audit pattern from scope to report—fewer follow-up questions, predictable effort.
An experienced team supports you beyond the individual report—including follow-up audits and related frameworks.
From the distinction between SOC 1 and IDW PS 951 to the question of which report your clients will accept: you will find the most important answers here.
Can't find your question? Please contact us directly.
All three pursue the same goal: providing evidence that a service provider's controls relevant to their clients' financial reporting are appropriately designed and effective. ISAE 3402 is the international standard from the IAASB, SOC 1 is the format according to the AICPA, and IDW PS 951 is the German standard from the IDW. Differences primarily exist in the report structure and the requirements of the respective region.
Generally, yes. With a properly aligned scope, IDW PS 951 and ISAE 3402 or SOC 1 can be audited in a single process. We will clarify which additional audit procedures or report components are necessary during the scoping phase.
Type 1 is suitable as an entry point or for short-term verification. For use in the context of an annual audit, clients and their auditors usually expect a Type 2 report.
No, not alone. ISAE 3402 focuses on controls relevant to financial reporting. For information security, availability, and data protection, SOC 2, C5, or ISO 27001 are suitable options. These can be linked with ISAE 3402 via a common control mapping.
Let's get in touch to discuss your requirements.
