ISAE 3402 readiness engagement vs a traditional Big-Four quote

What both models produce

Both models deliver the same object of testing to the external audit firm: a documented control environment aligned to ISAE 3402 control objectives, with policies, procedures, walkthrough documentation, and an evidence collection plan. Both stop at the point where the audit firm takes over. Neither the traditional advisor nor Veritise signs the assurance report — that would be circular; a service organisation cannot audit its own controls.

Because the object of testing is the same standard (ISAE 3402, issued by the IAASB), the auditor's fieldwork is comparable across both models. The difference is upstream, in how the environment is built and where it lives.

How they differ on price

A traditional advisory-firm readiness engagement for a mid-market SaaS or service organisation typically runs between 150,000 and 400,000 DKK — roughly £15k to £45k, or €20k to €55k — after scoping. Big-Four price tags at the higher end reflect brand loading, on-site presence, and larger delivery teams; boutique advisory firms come in lower but rarely under 100,000 DKK. Pricing is quoted on request, not published.

The Veritise readiness engagement is 30,000 DKK excluding VAT, agreed on a 30-minute discovery call where we look at the environment you already have. That is a one-off fee for the setup work; the ongoing environment runs on a Veritise Full Suite subscription at 3,000 DKK per month. Total first-year cost sits an order of magnitude below the traditional quote when the customer already has an existing GDPR or security posture to fold in.

The transparency difference is deliberate. The Veritise price is on the page because most of the variance is captured by two questions ("how many services in scope" and "how documented is your current environment"), both of which can be answered on the discovery call. Traditional readiness pricing is opaque partly because the scoping conversation is billable; the engagement effectively begins when the first email is sent.

How they differ on timeline

A traditional readiness engagement runs three to six months of build work before the audit firm starts fieldwork, depending on the depth of the existing control environment and the size of the delivery team. Big-Four engagements sometimes compress with more consultants at higher day rates.

The Veritise readiness engagement runs four to five weeks on average from discovery to audit firm handoff. It can extend where the customer is starting from a thin evidence base — flagged during the discovery call so nothing surprises later. After handoff, the Type II observation period runs on the platform for six to twelve months, driven by the customer's team with Veritise on call.

How they differ on ongoing operations

A traditional readiness engagement ends when the environment is handed to the audit firm. The controls, evidence, and documentation live in whatever tooling the customer used to build them — often SharePoint, Confluence, or a folder tree — and the customer's team runs the operating cadence themselves. Some advisory firms offer ongoing managed services at additional cost.

The Veritise engagement delivers the environment onto the Full Suite platform. Controls, evidence storage, tasks, vendor register, and walkthrough documentation live there. The customer's team operates the environment day to day; the platform captures the operating evidence the auditor samples during the Type II observation period. The subscription is what makes Type II practical to sustain across the observation period without a full-time compliance hire.

When the traditional model is the right choice

• The organisation is a bank, insurer, asset manager, or other complex financial-services group where multiple standards (SOC 1, ISAE 3402, ISAE 3000, internal controls over financial reporting) must be produced together and the auditor already has a Big-Four counterpart on the buy side.
• A dedicated on-site delivery team is required by policy or by the size and complexity of the environment (30+ services in scope, hundreds of controls, multiple sub-service organisations).
• The organisation has no existing platform to run the ongoing evidence collection on and no appetite to adopt one — the goal is a one-off Type I report with no plan for Type II.
• Procurement policy requires the advisory firm to also be recognisable as a Big-Four brand (some enterprise procurement documents specify a Big-Four supplier).

When the Veritise model is the right choice

• The organisation is a SaaS company, hosted platform, or service organisation with 20–500 employees and an existing GDPR or security posture that can feed the ISAE 3402 controls.
• The goal is Type I this year and Type II next — the observation period will be run in-house on a platform, not by rotating consultants.
• The buyer values price transparency and a fixed-scope engagement over a bespoke advisory relationship.
• The wider compliance environment (GDPR, security controls, vendor management) either already runs on Veritise Full Suite or will migrate to it — the ISAE 3402 environment ties into the same operating fabric.