Question

Summarize the purpose, approach, goals, and scope of SSAE 18.

Answer 1

Statement on Standards for Attestation Engagements is an auditing standard for service organizations and SSAE 18 came after SSAE 16. In April 2016, American Institute of Certified Public Accountants (AICPA) Auditing Standards Board (ASB) issued SSAE 18. This is valid for report dates of May 1 2017 and after.

Now, what are this attestation standards? They establish requirements and provide application guidance to auditors for performing and reporting on examination, review, and agreed-upon procedures engagements, including Service Organization Controls (SOC) attestations. SSAE 18 completely replaces SSAE 16 and many other SSAEs into a combined standard.

There are changes in SSAE 18 that affects the fashion in service organizations deal with sub-service organizations. Under this a service organization should

Identify all sub-service organizations

Include description of sub-service organization controls that the service organization relies on to provide the primary services to its customers.

SSAE 18 requires that

1. Service organization implement controls to monitor the effectiveness of relevant controls at the subservice organization; and
2. Service auditor to report on the controls the service organization implemented to monitor the relevant controls at the subservice organization.

Monitoring controls could include one or any combination of the following:

1. Reviewing and reconciling output reports or files
2. Periodic discussion with subservice organization personnel
3. Regular site visits
4. Testing controls at the subservice organization
5. Monitoring external communications
6. Reviewing SOC reports of the subservice organization’s system