June 28, 2017

SSAE 16 Report


Warning: Illegal string offset 'keywords_time' in /homepages/27/d172822364/htdocs/ssae/wp-content/plugins/internal-link-building/Internal_Link_Building.php on line 103

The SSAE 16 Type II Report now includes an additional section that SAS 70 did not, “Management’s Assertion”, which reflects the most noticeable change between SAS 70 and SSAE 16.

An SSAE 16 report can vary slightly depending upon the service auditor, but, typically include the following sections:

  • Independent service auditor’s report
  • Managements assertion of control environment
  • The service organization’s description of controls
    • Overview
    • Relevant aspects of the COSO framework
    • Detailed description of controls, Control objectives, controls and user control considerations
  • Tests of the controls and results of the tests performed (for Type II reports)
  • Other information provided by the service organization

Every auditing firm will have some minor differences in language used or formatting throughout the report, but, in the end all SSAE 16 reports must include these sections to be considered complete.