Certification, auditing, verification and training services related to integrated management systems, business processes and system integration

SSAE 16

Statement on Standards for Attestation Engagements (SSAE) No.16

SSAE 16
Statement on Standards for Attestation Engagements (SSAE) No. 16, is an attestation standard issued by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA). Specifically, SSAE 16 is an attestation standard geared towards addressing engagements conducted by practitioners (known as "service auditors") on service organizations for purposes of reporting on the design of controls and their operating effectiveness. As such, SSAE 16 engagements conducted by service auditors on service organizations will result in the issuance of either a SSAE 16 Type 1 or Type 2 Report.

  • Type 1 report - technically known as a "Report on Management's Description of a Service Organization's System and the Suitability of the Design of Controls".

  • Type 2 Report - technically known as a "Report on Management's Description of a Service Organization's System and the Suitability of the Design and Operating Effectiveness of Controls".

SSAE 16 is effectively replacing Statement on Auditing Standards No. 70 (SAS 70) as the primary standard for reporting on controls at service organizations. SAS 70 has been a highly valuable and globally accepted framework and one that has been amended a number of times for helping keep pace with the growing changes in regulatory compliance.

Who needs an SSAE 16 audit?

If your Company (the 'Service Organization') performs outsourced services that affect the financial statements of another Company (the 'User Organization'), you will more than likely be asked to provide an SSAE16 Type II Report, especially if the User Organization is publicly traded.

Some example industries include:

  • Payroll Processing
  • Loan Servicing
  • Data Center/Co-Location/Network Monitoring Services
  • Software as a Service (SaaS)