SSAE 18
Statement on Standards for Attestation Engagements 18 — current AICPA standard governing service organization audits.
SSAE 18 is the AICPA Auditing Standards Board's 2016 statement that consolidated and clarified the attestation standards previously contained in SSAE 10-17 and SSAE 16, recodifying them into the AT-C section structure (AT-C 105 common concepts, AT-C 205 examination engagements, AT-C 305 agreed-upon procedures, AT-C 320 reporting on controls at a service organization). It is the standard under which SOC 1, SOC 2, and SOC 3 examinations are conducted, and it materially strengthened requirements around service auditor responsibilities for subservice organizations (complementary subservice organization controls — CSOCs), monitoring of subservice organizations by service organizations, and consideration of the risks of material misstatement. Subsequent statements (SSAE 19 through SSAE 22) have refined specific aspects without replacing the SSAE 18 framework as the primary attestation standard for SOC reporting.
Core components
- AT-C 105 (concepts common to all attestation engagements)
- AT-C 205 (examination engagements)
- AT-C 305 (agreed-upon procedures engagements)
- AT-C 320 (reporting on examinations of controls at service organizations)
- Complementary subservice organization controls (CSOCs)
- Risk-of-material-misstatement assessment
- Subservice organization monitoring requirements
- Carve-out and inclusive method for subservice presentation
Primary use case
Professional standard governing CPA-performed attestation engagements, most prominently SOC 1, SOC 2, and SOC 3 reports on service organization controls.
Common criticisms
- Codification complexity creates interpretation variability across firms
- CSOC requirements imposed substantial monitoring burden on service organizations using subservice providers
- less prescriptive than ISO 27001 on specific control objectives
- AICPA scope limits international portability of SOC reports
- standards layered through multiple subsequent SSAEs creates navigability friction.
Lineage
- Parent of
- SOC 2
- Siblings
- SOC 2