Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization, was finalized by the Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA) in January 2010. SSAE 16 effectively replaces SAS 70 as the authoritative guidance for reporting on service organizations. SSAE 16 was formally issued in April 2010 and became effective on June 15, 2011. SSAE 16 was drafted with the intention and purpose of updating the US service organization reporting standard so that it mirrors and complies with the new international service organization reporting standard – ISAE 3402. SSAE 16 also establishes a new Attestation Standard called AT 801 which contains guidance for performing the service auditor’s examination. Many service organizations that previously had a SAS 70 service auditor’s examination (“SAS 70 audit”) performed converted to the new standard in 2011 and now have a SSAE 16 report instead – also referred to as a Service Organization Controls (SOC) 1 report. | User organizations that obtain a Service Auditor’s Report from their service organization(s)
|