SSAE 18 (AT-C 320): The Standard Behind SOC 1 Reports

SSAE 18 (Statement on Standards for Attestation Engagements No. 18) is the attestation standard issued by the AICPA Auditing Standards Board that governs SOC 1 engagements in the United States. It became effective on May 1, 2017, replacing SSAE 16. The specific section governing SOC 1 reports is AT-C Section 320 — "Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting." SSAE 18 sets the rules that CPA firms must follow when examining and opining on a service organization's controls.

SSAE 18 replaced SSAE 16 effective May 1, 2017, with three key changes: (1) it introduced an explicit risk-assessment requirement — the CPA must now identify and assess risks of material misstatement before designing their testing approach; (2) it enhanced subservice-organization monitoring requirements — the service auditor must evaluate whether the service organization adequately monitors its subservice providers' controls; (3) it reorganized the entire SSAE suite into a clarified AT-C format for consistency with other AICPA professional standards. The management assertion requirement introduced by SSAE 16 was carried forward unchanged.

Not directly. SSAE 16 replaced SAS 70 in June 2011, and then SSAE 18 replaced SSAE 16 in May 2017. The full evolution is SAS 70 (1992-2011) to SSAE 16 (2011-2017) to SSAE 18 (2017-present). SAS 70 was an auditing standard; SSAE 16 reframed the engagement as an attestation and introduced the management assertion; SSAE 18 added risk assessment and enhanced subservice monitoring. References to "SAS 70 reports" are outdated — the correct term for over a decade has been "SOC 1 report under SSAE 18."

AT-C Section 320 of SSAE 18 requires: (1) a management description of the service organization's system, prepared using the AICPA description criteria; (2) a written management assertion that the description is fairly presented and controls are suitably designed (and for Type 2, operating effectively); (3) the service auditor to perform a risk assessment before designing test procedures; (4) the service auditor to evaluate subservice-organization monitoring; (5) the service auditor to issue a report with their opinion, description of tests performed, and results. The report must distinguish between Type 1 (design only) and Type 2 (design plus operating effectiveness).

ISAE 3402 is the international equivalent of SSAE 18, issued by the International Auditing and Assurance Standards Board (IAASB). It governs the same type of engagement — examining controls at a service organization relevant to user entities' financial reporting — but is used outside the United States. The two standards are substantially aligned in structure and requirements. Service organizations with both US and international user entities often issue dual reports that reference both SSAE 18 and ISAE 3402 to satisfy both audiences.

Only a licensed CPA firm can issue a SOC 1 report. The firm must be registered with a US state board of accountancy (or equivalent national body for ISAE 3402) and must be independent of the service organization — meaning the firm that performs the attestation cannot have designed, implemented, or operated the controls being examined. Consulting firms like Tranquility Cybersecurity help service organizations prepare for the examination, but the attestation opinion must come from an independent CPA firm.

The AICPA description criteria require the system description to cover: (1) the types of services provided; (2) principal service commitments and system requirements; (3) the five components of the system — infrastructure, software, people, procedures, and data; (4) control objectives and the specific controls designed to achieve them; (5) complementary user entity controls (CUECs) that user entities must operate; and (6) complementary subservice organization controls (CSOCs) for any subservice providers. The description must be specific enough for user-entity auditors to evaluate the impact on their own financial-statement audits.

SSAE 16 did not include an explicit risk-assessment requirement for the service auditor. SSAE 18 requires the CPA to perform a risk assessment — identifying and evaluating the risks of material misstatement in the system description, the suitability of control design, and (for Type 2) operating effectiveness — before designing and executing test procedures. This means the CPA now tailors their testing based on assessed risk: higher-risk controls receive more extensive testing rather than a uniform flat sample across all controls.

The AICPA Auditing Standards Board issues SSAE 18, which governs SOC 1 attestation engagements. The PCAOB (Public Company Accounting Oversight Board) sets auditing standards for audits of public companies registered with the SEC. SOC 1 reports are attestation engagements — not audits of public companies — so they fall under AICPA standards, not PCAOB standards. However, when a user entity is a public company, their external auditor (who follows PCAOB standards for the financial-statement audit) will reference the SOC 1 report as part of their assessment of internal controls.

Yes. A dual report references both standards and satisfies both US and international user-entity auditors. The CPA firm issuing the report must be qualified under both frameworks — typically a global accounting firm or a US CPA firm with the appropriate credentials. The dual report follows the more stringent requirement where the two standards differ, which is a minimal concern since they are substantially aligned. Dual reporting is common for service organizations with a geographically diverse user-entity base.