SSAE 16 Overview
Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization, has been finalized by the Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA). SSAE 16 effectively replaces SAS 70 by superseding the guidance for service auditors in AU section 324 of the AICPA Professional Standards. SSAE 16 was formally issued in April 2010 with an effective date of June 15, 2011. SSAE 16 was drafted with the intention and purpose of updating the US service organization reporting standard so that it mirrors and complies with the new international service organization reporting standard – ISAE 3402.
For service organizations that currently have a SAS 70 service auditor’s examination (“SAS 70 audit”) performed, some changes will be required to effectively reporting under the new SSAE 16 standard. However, it is currently anticipated that these changes will not be significant. The AICPA plans to issue a new Audit Guide for applying SSAE 16 in early 2011. Additional information will be provided here as it becomes available.