4 Mins
Written by: Emma Tilley
Manager, Internal Audit
Last reviewed: 16 October 2026Organisations considering ISAE 3402 assurance often encounter an important decision early in the process: should they obtain a Type 1 or Type 2 report?
Both provide valuable independent assurance, but they serve different purposes and provide different levels of confidence to customers, regulators and auditors.
What Is an ISAE 3402 Type 1 Report?
A Type 1 report assesses:
- The design of controls
- Whether controls have been implemented
- A specific point in time
In effect, the report answers:
“Are the controls suitably designed and in place?”
Type 1 reporting can be an appropriate starting point for organisations obtaining assurance for the first time.
What Is an ISAE 3402 Type 2 Report?
A Type 2 report assesses:
- The design of controls
- The implementation of controls
- Operating effectiveness over a defined period
It answers:
“Have the controls operated effectively over time?”
Because it includes testing over several months – typically a 6-to-12-month period – Type 2 reporting generally provides stronger assurance.
Key Differences Between Type 1 and Type 2
Timing
- Type 1 assesses a specific date.
- Type 2 assesses a defined reporting period.
Assurance Level
- Type 1 confirms controls exist.
- Type 2 confirms controls are working effectively.
Customer Expectations
Many larger organisations and external auditors prefer Type 2 reports because they provide greater confidence given that testing is spread across the year rather than a specific point in time.
Testing Requirements
Type 2 engagements include testing of control operation throughout the reporting period.
Which Report Should Your Organisation Choose?
A Type 1 report may be suitable where:
- Assurance reporting is new
- Controls have recently been formalised
- Customers require initial evidence of control design
A Type 2 report may be appropriate where:
- Customers require greater assurance
- External auditors will seek reliance
- Controls are well established
- The organisation already has a mature governance framework
Common Misconceptions
Type 1 Is Not a “Lite” Version
Although narrower in scope, Type 1 still requires robust control design and documentation.
Type 2 Does Not Mean Perfection
Control exceptions can still occur. The focus is on whether controls operated effectively overall.
What Should You Do Before Starting?
Before pursuing either type of report, organisations should understand their readiness position.
A structured readiness assessment can identify:
- Control gaps
- Documentation weaknesses
- Evidence requirements
- Process improvements
To learn more, read our guide: How to Prepare for an ISAE 3402 Audit.
Conclusion
Both Type 1 and Type 2 reports provide valuable assurance. The right option depends on customer expectations, control maturity and reporting objectives. Understanding the differences early can help organisations select an approach that meets stakeholder requirements while supporting long-term governance objectives.
FAQs: ISAE 3402 Type 1 vs Type 2
Neither is inherently better. The right option depends on your organisation’s maturity, customer requirements and assurance objectives. Type 2 generally provides a higher level of assurance because it assesses operating effectiveness over time.
Yes. Many organisations begin with a Type 1 report to demonstrate control design before progressing to a Type 2 report once controls have operated consistently over a reporting period.
A Type 2 report typically covers a period of six to twelve months, although the exact timeframe will depend on organisational requirements and reporting objectives.
Many larger organisations and external auditors prefer Type 2 reports because they provide evidence that controls have operated effectively over an extended period.
No. A Type 2 report does not guarantee perfection. The report assesses whether controls were operating effectively overall, and any exceptions identified will be reported.
In many cases, yes. A Type 1 report can be a practical first step where controls have recently been formalised or assurance reporting is new to the organisation.
