Statement on Standards for Attestation Engagements (SSAE) No.16
- Type 1 report - technically known as a "Report on Management's Description of a Service Organization's System and the Suitability of the Design of Controls".
- Type 2 Report - technically known as a "Report on Management's Description of a Service Organization's System and the Suitability of the Design and Operating Effectiveness of Controls".
SSAE 16 is effectively replacing Statement on Auditing Standards No. 70 (SAS 70) as the primary standard for reporting on controls at service organizations. SAS 70 has been a highly valuable and globally accepted framework and one that has been amended a number of times for helping keep pace with the growing changes in regulatory compliance.
Who needs an SSAE 16 audit?
If your Company (the 'Service Organization') performs outsourced services that affect the financial statements of another Company (the 'User Organization'), you will more than likely be asked to provide an SSAE16 Type II Report, especially if the User Organization is publicly traded.
Some example industries include:
- Payroll Processing
- Loan Servicing
- Data Center/Co-Location/Network Monitoring Services
- Software as a Service (SaaS)