SSAE — US attestation standards behind SOC reports
SSAE (Statements on Standards for Attestation Engagements) are the attestation standards of the American Institute of Certified Public Accountants (AICPA). Independent CPA firms use them to examine and report on subjects such as an organisation’s internal controls. The best known is SSAE 18, which since 2017 has been the basis for SOC 1, SOC 2 and SOC 3 reports and has since been amended by later SSAEs. The aim is to give clients, their auditors and partners confidence that the organisation’s processes are under control and carried out according to the prescribed rules.
Why SSAE matters
SOC reports matter to organisations that provide financial and IT services to clients: a SOC 1 report gives evidence that the controls affecting clients’ financial reporting are effective, and a SOC 2 report covers security and the other Trust Services Criteria. Preparing for a SOC report under SSAE 18 strengthens controls, increases transparency, reduces the risk of errors and fraud, and builds trust in the company’s processes.
Who needs SOC reports
SOC reports are obtained by companies that provide services in finance, accounting, IT infrastructure, cloud services and business process outsourcing (BPO). They matter most for companies that have clients in the United States or handle strictly regulated data, where independent confirmation is required that controls exist and work. The international counterparts are ISAE 3402, for controls relevant to clients’ financial reporting (like SOC 1), and ISAE 3000, under which reports similar to SOC 2 are issued.
Steps to a SOC report
- Analysing existing controls and identifying risks in financial reporting.
- Defining and documenting internal control policies and procedures.
- Setting up the monitoring and review of controls.
- Preparing for the independent examination under SSAE 18.
- The examination by an independent firm of certified public accountants (a CPA firm), which issues the SOC report.
Benefits of a SOC report
- More trust from investors and clients.
- Evidence that internal controls and processes are effective.
- Meeting the audit and reporting requirements of clients and partners in the United States.
- A lower risk of fraud and irregularities.
- Controls that can be mapped to ISO 27001, so the same work supports both.
How STANDARDISO can help
STANDARDISO helps organisations set up and improve their internal controls for an SSAE 18 examination. Our team helps document processes, analyse risks and prepare for the independent examination, which is carried out by a CPA firm. Our aim is to help you meet the requirements and build trust with your clients and regulators. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.