What is SSAE 16? That's seems to be the chatter of late for many CPA firms, service organizations, and other interested parties. Statement on Standards for Attestation Engagements no. 16 (SSAE 16) is the new "attest" standard put forth by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA). For reporting periods ending on or after June 15, 2011, SSAE 16 will become the new standard for reporting on controls at service organizations, essentially replacing Statement on Auditing Standards no. 70, simply known as SAS 70. Learn more about NDB's complimentary SOC 1 Policy Packets and SOC 2 Policy Packets. They truly make a big difference in helping service organizations save thousands of dollars on SOC compliance.
SSAE 16 represents an adoption towards more globally accepted accounting principles, which clearly can be seen when comparing the new U.S. standard from the AICPA to that of its international equivalent, ISAE 3402, put forth by the International Auditing and Assurance Standards Board (IAASB), a standard-setting board of the International Federation of Accountants (IFAC).
SSAE 16 also brings about a number of requirements for which service organizations will need to be well aware, most importantly that management of the service organization must provide a description of its "system" along with a written statement of assertion. Both of these requirements differ from the previous SAS 70 auditing standard in the following manner:
• The SAS 70 auditing standard only called for a description of "controls", while the SSAE 16 attest standard now requires a description of its "system", which is considered to be more comprehensive and expansive than that of the SAS 70 description of "controls.
• SSAE 16 requires a written statement of assertion, something that was not required under SAS 70 Type I or Type II audits. This written statement of assertion must be crafted by management and contain a number of essential clauses for which management of the service organization will effectively "assert" to. What's important to note is that the written statement of assertion can be included within or attached to the description of the "system". A competent, well-qualified CPA firm can help assist you with this matter.