An Overview of SSAE 16 Standards and SOC Reporting

The Statement on Standards for Attestation Engagements (SSAE) No. 16, effectively replaced the former standard SAS 70 in 2010 as the authoritative guidance for reporting on controls at service organizations. Today, many service organizations have converted to the new standard and now have a SSAE 16 report, also referred to as a Service Organization Controls (SOC) 1 report.

This course provides an overview of SSAE 16 standards and the approach to compliance reporting on controls at service organizations as well as the responsibilities of those organizations being audited. We also discuss:

• Outsourcing and risk

• Terms and definitions

• Why SAS 70 was replaced with SSAE 16, and the key differences between the two

You also learn about the three SOC reporting options and two types of reports, with emphasis on the SOC 1 report. Also covered:

• Various sections of SOC 1

• How to write a description of a service organizations control environment, as well as managements written assertion

• How to derive value from the reports to evaluate service organizations services