What’s the purpose of an SSAE 16 audit and should I pursue one? If you’re new to the world of information security audits, check out this comprehensive guide on the history of SSAE 16, why it replaced the SAS 70, and how becoming SSAE 16 compliant could benefit your business.

SSAE 16: The Past and the PresentOutsourcing critical business functions, such as IT or HR, is a common practice among many businesses, today. While outsourcing is a great way to cut operational costs and acquire resources that aren’t available internally, it doesn’t come without its risks. It is especially crucial to consider how outsourcing functions to service organizations could impact your internal control over financial reporting (ICFR).

In accordance with Sarbanes-Oxley (SOX), publicly traded companies are responsible for maintaining an effective system of internal control over financial reporting (ICFR). Such emphasis on governance and risk management when it comes to reporting on controls at a service organization, is the reason many organizations have chosen to require their vendors, who may have an impact on their ICFR, to obtain an SSAE 16 (SOC 1) Attestation Report.

In 2010, the AICPA replaced SAS 70 with SSAE 16 in order to update and improve that testing standard. In 2016, SSAE 18 was issued to replace SSAE 16 and provide further improvements. SSAE 18 is the current standard that SOC 1 audits use.

Out with the Old: Replacing the SAS 70

Out with the Old: Replacing the SAS 70

To make a long story short, CPAs in the past were using the SAS 70 to report on things other than financial reports, however, the SAS 70 was never intended to do so. By introducing a new attestation standard to assess service organizations, the AICPA developed improved assurance by replacing the SAS 70 with the Statement on Standards for Attestation Engagement No. 16, or SSAE 16.

Not only does the SSAE 16 provide a more comprehensive and descriptive assessment of controls, it also allowed user organizations to appropriately assess the reliability of the controls at a service organization.

SSAE 16 vs. SAS 70: What are the Differences?

SAS 70, Cruising with The Auditing Standard

SSAE 16 vs. SAS 70: What are the Differences?

What’s the difference between SSAE 16 and SAS 70? One of the key differences between the SAS 70 and the SSAE 16 is that the SAS 70 is an “auditing” standard, whereas the SSAE 16 is an “attestation”. When the AICPA made the decision to replace the SAS 70, they thought it more appropriate for a service organization audit to be an examination of a system, which is different than an audit of financial statements.

SSAE 16, Going Deeper with Attestation

What are the key differences between the SAS 70 and SSAE 16?

The SSAE 16 report requires a description of a system along with a written assertion by management on the design and operating effectiveness of the controls being reviewed. The SAS 70, however, lacked the level of detail that the SSAE 16 offers. The SAS 70 simply provided a description of controls and did not include any type of management assertion.

New and Improved: The SSAE 16 Audit Report

New and Improved: The SSAE 16 Audit Report

The SSAE 16 has been around long enough now to have gained popularity and familiarity by both service organizations and their clients. However, we still receive a fair amount of questions regarding the purpose of an SSAE 16 audit report, the components, and the benefits of a service organization obtaining an SSAE 16 audit report.

Have you been asked for an SSAE 16 report?
As mentioned before, the purpose of an SSAE 16 report is to report on the controls at a service organization that may have an impact on their clients’ financial reporting.

If you’re an organization who provides hosting services, data management services, etc. to a publicly traded company, it is likely you have been requested to pursue an SSAE 16 audit, and if not, you probably will at some point. An SSAE 16 report allows organizations to assess the risks associated with doing business with particular service providers.

Components of an SSAE 16 Audit Report

Components of an SSAE 16 Audit Report

There are not set controls for an SSAE 16, as each is unique to the service organization and the type of business they are doing. However, there are common criteria and common control objectives that typically make up the components of an SSAE 16 or SOC 1 report. This includes the independent service auditor’s report, management’s written assertion, a description of the system, control objectives and the testing of operating effectiveness of the controls. There are two types of SSAE 16 reports. An SSAE 16 Type I report is an attestation of controls at a service organization at a point in time. An SSAE 16 Type II report is an attestation of controls at a service organization over a period of time. It is often recommended that service organizations begin with an SSAE 16 Type I report, and then move to an SSAE 16 Type II report to demonstrate the maturing of their environment.

Benefits of Pursuing an SSAE 16 Audit Report

Benefits of Pursuing an SSAE 16 Audit Report

There are several benefits associated with obtaining an SSAE 16 audit report. First, it is a great way to demonstrate your commitment to delivering high quality services to your clients. It is also an important step in gaining the client trust you need to develop and grow your business. By engaging a third-party auditing firm to conduct an SSAE 16 audit engagement, you will not only satisfy current client demands, but gain a competitive advantage and have the opportunity to win new business.

The evolution of the reporting on controls at a service organization has inevitably brought more assurance and opportunity to the marketplace. The SSAE 16 audit report is a great way for organizations to demonstrate that they have the proper internal controls in place to protect client data. If you have any questions regarding obtaining an SSAE 16 audit report, whether it is the appropriate engagement for your organization, or how to prepare for your SSAE 16 audit, contact us today.