SSAE No. 16 Reporting on Controls at a Service Organization

The ASB has issued Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization. With the issuance of this standard the requirements and guidance for service auditors and user auditors moves from SAS No. 70, Service Organizations (AU section 324) to SSAEs. Recall that the entity that outsources a task or function is known as a user entity, and the entity that performs a service for user entities is known as a service organization. Examples of service organizations include investment advisers that invest assets for user entities or a data center that provides applications and technology that enable user entities to process financial transactions.

SSAE No. 16 contains the requirements and guidance for a service auditor reporting on a service organization’s controls. It enables a service auditor to perform two types of engagements:

• A type 2 engagement in which the service auditor reports on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives included in the description throughout a specified period.
• A type 1 engagement in which the service auditor reports on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design of the controls to achieve the related control objectives included in the description as of a specified date.

SSAE No. 16 is effective for service auditors' reports for periods ending on or after June 15, 2011. Earlier implementation is permitted.

Become a subscriber.
To receive more detailed updates, become a subscriber by going to http://www.cpafirmsupport.com/ and clicking on “Join Us.”