# ISAE 3402

ISAE 3402 is the international assurance standard under which an independent auditor examines a service organization's controls. A Type II report tests whether the controls operated effectively over a period, typically a year, making it the assurance banks request from critical technology providers.

## Why banks ask vendors for a Type II report

A Type I report describes controls at a point in time; Type II proves they operated over months, covering change management, access control, key management, and operations. For custody technology, it is the difference between documented and demonstrated.

Taurus maintains ISAE 3402 Type II assurance alongside ISO 27001 certification and DORA compliance, and is itself a FINMA-regulated securities firm, audited to banking standards.

FAQ:

- What should a bank check in a vendor's ISAE 3402 report? Scope and exceptions: whether key management and the production custody platform are inside scope, which controls had exceptions, and how findings were remediated. A clean, well-scoped Type II is strong evidence; an out-of-scope one is marketing.

Related: https://www.taurushq.com/protect/ https://www.taurushq.com/glossary/dora/ https://www.taurushq.com/glossary/cmta-dacs/

Learn more: https://www.taurushq.com/glossary/isae-3402/