SAS 70 Out (Soon), SSAE 16 In
Did you know SAS 70 Standard is Changing?
In an effort to clarify standards and converge with international standards, changes to SAS 70 requirements have been made by the AICPA. The new standard is Statements on Standards for Attestation Engagements (SSAE) 16 or SSAE 16. These changes, which affect the service organization and the service auditors completing the SSAE 16 engagement, will be effective for periods ending June 15, 2011.
What is Changing?
That proposed changes to the current SAS 70 standard will add additional detail to the report and require more input from the service organization. Some of the proposed changes include:
- Service organization will provide a written assertion that will be listed in the report with the service auditor opinion that is included in current reports
- Type 2 reports will include an opinion on the design of controls over the period under review and not just as of a point in time as it is currently
- Internal auditor assistance will have to be detailed in the report
- No reduction of testing performed will be allowed as the result of prior or other examinations even if completed during the period under review
- Users of the report will be restricted to customers of the client during the period under review for a type 2 and at the point of the description covered by the report for a type 1
How does this Affect Companies Receiving a New SSAE 16 Report?
While the main structure of the SAS 70 report will remain unchanged for most service organizations (most, but not all, include adequate descriptions of processes), additional information will be added to the reports, which in turn could require additional effort in completing the report. With the proposed changes, companies receiving the new SSAE 16 report will be required to take a more active role in the completion of the SSAE 16 through the inclusion of their own written assertion.
What do Companies do to Prepare?
The audit firm completing the SSAE 16 should be abreast of the changes and guide the company through any additional procedures or changes to existing procedures that will occur. Companies should start discussions with their audit firms now to better prepare for when the changes go into effect.
2 comments
Leave a Reply
About Linford & Company
We are specialists in the performance of SSAE 16/SOC 1, SOC 2, and royalty audits across technical disciplines. We issue SSAE 16/SOC 1 and SOC 2 reports for a wide variety of service organizations that go to many of the largest user organizations in the world. We also perform royalty audits on some of the largest consumer brands in the world.
 |
Follow us on our blog where we provide information about our firm, insight on guidance relevant to our services. |
 |
Subscribe to our newsletter. |
What law is requiring this? I have not seen anything from NCUA, FDIC, etc on this.
Great question. The American Institute of Certified Public Accountants (AICPA) is the organization that governs the Statements on Auditing Standards (SAS) and Statements on Standards for Attestation Engagements (SSAE). Here is a link for the AICPA’s announcement on the switch from SAS 70 to SSAE 16.