Written by Sue Wells, A-LIGN on December 19, 2016
When service organizations receive a SOC 1 examination, it is performed under the SSAE 16 or “Statements on Standards for Attestation Engagements 16, Reporting on Controls at a Service Organization” standard.
In Spring 2016, The AICPA’s Auditing Standards Board (ASB) completed the clarity project, the result of which was the issuance of the SSAE 18 standard, “Concepts common to all Attestation Engagements”. This new standard replaces SSAE 16 for SOC 1 engagements and goes into effect for reports dated after May 1, 2017.
It is important to note that the SSAE 16 standard was specific to service organizations and the SSAE 18 is for all attestation engagements. This means that we can no longer refer to SOC 1 as an SSAE 16 examination and it will not be replaced by the term SSAE 18 examination. Instead, it will simply be referred to as the SOC 1.
Despite the potential for confusion related to the naming of the examinations and reports, the actual changes to what a service organization has to do to prepare for an examination is not extensive. Here are four changes that come with SSAE 18 that affect the SOC 1 examination.
Vendor Management
The most significant change in the requirements that has to be met by a service organization is ensuring that its vendor management program for sub-service providers (for example colocation facilities) is significantly robust. SSAE 18 is requiring that service organizations implement processes that monitor the controls at sub-service organizations. SSAE 18 provides the following control suggestions:
- Review and reconcile output reports.
- Hold periodic discussions with the sub-service organization.
- Make regular site visits to the sub-service organization.
- Test controls at the sub-service organization by members of the service organization’s internal audit function.
- Review Type I or Type II reports on the sub-service organization’s system.
- Monitor external communications, such as customer complaints relevant to the services by the sub-service organization.
Risk Assessment
Another change in what will be required by SSAE 18 will be in the area of more specific requirements as opposed to the existing general considerations of risk via a risk assessment. SSAE 18 requires service auditors to obtain a more in-depth understanding of the development of the subject matter than currently required, in order to better identify the risks of material misstatement in an examination engagement. This, in turn, should lead to an improved linkage between assessed risks and the nature, timing, and extent of attestation procedures performed in response to those risks.
Complementary Sub-service Organization Controls
SSAE 16 required that service organizations provide a listing of controls that should be performed by user organizations.
In order to recognize that more organizations are outsourcing key functions to their own set of sub-service organizations, SSAE 18 introduces the concept of “Complementary Sub-service Organization” controls. This concept establishes and defines the controls for which user entities must now assume in the design of the system description. Another key factor related to these complementary controls is that they are necessary for the achievement of control objectives in the report. SSAE 18 provides more guidance around this area, and will hopefully lead to more consistent reporting across entities and practitioners.
Written Assertion Requirement
The final change to the SOC 1 is the requirement, per SSAE 18, that the service auditor obtains a written assertion. This written assertion is the statement found within the SOC report wherein the service organization asserts that the system description provided is essentially true and complete. This statement has always been contained within the SOC 1 reporting document but the requirement that the service organization signs the document was optional. In practice, the majority of service organizations have already been signing this document, as a way to strengthen the credibility of the report. Accordingly, there will not be significant changes to what either the service auditor or service organization will have to do to meet this requirement.