SSAE 18

SSAE 18
Name	SSAE 18
Abbreviation	SSAE 18
Issued	2017
Issuer	AICPA
Related	SSAE 16, SOC 1, SOC 2, PCAOB

SSAE 18 SSAE 18 is an attestation standard issued to strengthen reporting on service organizations' controls, intended to improve consistency in examinations and reporting for stakeholders including auditors, regulators, and customers. It aligns attestation procedures with contemporary auditing standards and responds to evolving expectations from organizations such as the Securities and Exchange Commission, Federal Reserve Board, International Auditing and Assurance Standards Board, and professional firms like Deloitte, PricewaterhouseCoopers, Ernst & Young, and KPMG. The standard interacts with frameworks used by JPMorgan Chase, Bank of America, Amazon Web Services, Microsoft Azure, and other service providers.

Background and Purpose

SSAE 18 emerged from efforts by the American Institute of Certified Public Accountants to refine attestation guidance after prior pronouncements from bodies including the Financial Accounting Standards Board, the Public Company Accounting Oversight Board, and the International Federation of Accountants. It builds on precedent set by engagements involving firms such as Goldman Sachs, Morgan Stanley, Citigroup, and Wells Fargo where reliance on third-party controls by organizations like Visa and Mastercard highlighted the need for greater consistency. Key drivers included audit quality concerns raised in high-profile events like the 2008 financial crisis and regulatory responses such as the Dodd–Frank Wall Street Reform and Consumer Protection Act.

Key Changes from SSAE 16

The standard introduced clarifications and new requirements compared with SSAE 16, emphasizing processes familiar to auditors at Grant Thornton and BDO. Changes included strengthened requirements for monitoring of subservice organizations similar to oversight practices at Facebook, Google, and Apple, improved documentation expectations akin to procedures used by Ernst & Young in client engagements with Pfizer and Johnson & Johnson, and enhanced consideration of complementary user entity controls observed by Target and Home Depot. It also addressed correspondence with international practices from the International Auditing and Assurance Standards Board and harmonized terminology used by the AICPA and PCAOB.

Scope and Types of Reports (SOC 1, SOC 2 relationship)

SSAE 18 governs attestation engagements that produce SOC reports such as SOC 1 and informs the relationship with SOC 2 reports produced under AICPA Trust Services Criteria, relevant to entities including Salesforce, Dropbox, Adobe Systems, and Slack Technologies. SOC 1 reports focus on controls relevant to financial reporting used by organizations like American Express and Mastercard, whereas SOC 2 reports address criteria concerning security and availability applicable to providers like Oracle and IBM. Users and auditors from firms such as KPMG and PricewaterhouseCoopers rely on these reports when assessing risk in transactions with companies such as ExxonMobil and Chevron.

Applicability and Compliance Requirements

Applicability encompasses service organizations ranging from cloud providers like Amazon Web Services and Microsoft Azure to payroll processors such as ADP and payment processors such as Stripe and PayPal. Compliance requires documented monitoring, monitoring processes similar to those implemented by Intel and NVIDIA, and evidence of management assertions comparable to reporting by Procter & Gamble and Unilever. Regulatory stakeholders including the SEC, Federal Deposit Insurance Corporation, and central banks like the European Central Bank may use SSAE 18 reports when evaluating third-party risk in institutions like Deutsche Bank and UBS.

Implementation and Auditor Responsibilities

Auditors performing SSAE 18 engagements—whether from global firms such as Deloitte, Ernst & Young, KPMG, PricewaterhouseCoopers, or regional practices—must exercise professional skepticism and adhere to documentation standards set by the AICPA and informed by PCAOB guidance. Responsibilities include risk assessment, testing of controls, consideration of subservice organizations used by entities like Accenture and Capgemini, and issuing reports that permit users such as Meta Platforms and Twitter to make informed reliance decisions. Training and quality control measures reflect practices from institutions like Columbia University and Stanford University continuing professional education programs.

Impact on Service Organizations and Users

Service organizations including Amazon, Google, Microsoft, Salesforce, and financial institutions such as JPMorgan Chase and Bank of America experienced increased emphasis on vendor management, control documentation, and disclosure consistent with investor and regulator expectations exemplified by BlackRock and Vanguard Group. Users of SOC reports—auditors from firms like BDO and compliance officers at corporations such as General Motors and Ford Motor Company—benefit from clearer reporting that supports reliance decisions, due diligence, and integration with enterprise risk management frameworks used by Siemens and General Electric.

Category:Auditing standards