Warning: Illegal string offset 'keywords_time' in /homepages/27/d172822364/htdocs/ssae/wp-content/plugins/internal-link-building/Internal_Link_Building.php on line 103
SSAE 16 is the SAS 70 Replacement and adds a new requirement that the service auditor is required to obtain a written assertion from management of the service organization about the fairness of the presentation of the description of the service organization’s system and about the suitability of the design and, in a type 2 engagement, the operating effectiveness of the controls. That assertion typically is included within the service auditor’s report or within in the description of the service organization’s system. In addition to the required management assertion, there are other substantive changes introduced in the switch to SSAE 16, including:
- The service auditor may not use evidence obtained in prior engagements about the satisfactory operation of controls in prior periods to provide a basis for a reduction in testing, even if it is supplemented with evidence obtained during the current period.The service auditor is required to identify in the description of tests of controls any tests of controls performed by internal auditors and the service auditor’s procedures with respect to that work.
- In a type 2 engagement, the service auditor’s opinion on the description of the service organization’s system and on the suitability of the design of controls covers a period (the same period as the period covered by the service auditor’s tests of the operating effectiveness of controls). In SAS no. 70, the opinion on the description and on the suitability of the design of controls in a type 2 report is as of a specified date, rather than for a period.
- The service auditor’s examination report must contain the report elements identified in paragraph .85 of AT section 101. (These report elements are tailored to a service auditor’s engagement in paragraphs 52 and 53 of SSAE no. 16.)