ASSURANCE AND ATTESTATION

Assurance and attestation

Assurance and attestation

Introduction

Statement on Standards for Attestation Engagements No. 16 (SSAE 16), Service Organizations, is a widely recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). A service auditor's examination performed in accordance with SSAE 16 (“SSAE 16 Audit”) is widely recognized, because it represents that a service organization has been through an in-depth audit of their control objectives and control activities, which often include controls over information technology and related processes. In today's global economy, service organizations or service providers must demonstrate that they have adequate controls and safeguards when they host or process data belonging to their customers. In addition, the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 make SAS 70, and now SSAE 16, audit reports even more important to the process of reporting on the effectiveness of internal control over financial reporting.

Discussion

SSAE 16 is the authoritative guidance that allows service organizations to disclose their control activities and processes to their customers and their customers' auditors in a uniform reporting format. The issuance of a service auditor's report prepared in accordance with SSAE 16 signifies that a service organization has had its control objectives and control activities examined by an independent accounting and auditing firm. The service auditor's report, which includes the service auditor's opinion, is issued to the service organization at the conclusion of a SSAE 16 examination.

SSAE 16 provides guidance to enable an independent auditor (“service auditor”) to issue an opinion on a service organization's description of controls through a Service Auditor's Report (see below). SSAE 16 does not specify a pre-determined set of control objectives or control activities that service organizations must achieve. Service auditors are required to follow the AICPA's standards for fieldwork, quality control, and reporting. A SSAE 16 Audit is not ...