We had SAS 70, then SSAE 16... now SSAE 18 will be making an entrance in May of this year. SSAE 18 is a little different, so we’ve outlined some key points for you below to assist with your understanding and preparation for reviewing SOC reports going forward.
Key Points to Know First
Before we dive into what SSAE 18 is all about, it's important to know a few points to base your understanding.
- SOC 1 and SSAE 16 will no longer be synonymous. SOC 1’s will only be SOC 1’s.
- The SSAE 18 does not directly replace the SSAE 16. The SSAE 18 is a simplified standard covering many other standards, SSAE 16 was just one. The SSAE 18 causes the SSAE 16 to be retired though as 16 is covered within 18.
- If you request an SSAE 16/SOC 1 now, you’ll still request a SOC 1, just without reference to SSAE 16 or 18.
- The SSAE 18 does not affect SOC 2 or 3’s as they are covered under a different standard than the SSAE 16 was.
What is SSAE 18?
SSAE 18 requires a new creation and mandatory inclusion of Complementary Subservice Organization Controls when applicable. This will provide additional clarity of how your vendor is addressing their own vendor management obligations. Therefore, your vendors who use vendors of their own (your fourth parties) now must identify functions and controls that proves your fourth parties are performing.
The purpose for the creation of the SSAE 18 was to clarify the auditing standards and to reduce duplication within similar standards covering Examinations, Reviews and Agreed-Upon Procedure engagements, specifically SSAE Nos. 10-17. These now fall under SSAE 18.
We find this to be an interesting, and much needed, turn of events. Vendor Management is no longer just your problem, it’s also your vendor’s problem.
Our customers who use our SOC Analysis service already know that subservice organizations have been a focus in our analyses and this update will further our ability to provide even more insight into the information security position of your vendors.
Bad News About SSAE 18
The bad news is this does not provide you with any additional assurance as the scope of your vendor’s audit will not include the operating effectiveness of the controls at your vendor’s subservice organization. However, it will provide the guidance you need to perform an informed review of the subservice organization’s SOC 1 or 2 report or other available and comparable documentation. To learn more about these reports, download our Understanding the Differences Between a SOC 1, 2 and 3 infographic.
When can you expect to see the new SSAE 18?
As mentioned earlier, SSAE 18 will be effective May 1, 2017 and you will no longer use SSAE 16. Early adoption is available now. By mid to late 2017, you should begin to see the first SSAE 18’s being provided by vendors.
Related Key SOC 1 Updates
A few SOC 1 updates include:
- Requirement of Risk Assessments based on control objectives within the SOC
- Refined Complementary User Entity Controls (CUECs) so that only controls that directly relate back to the product/service in scope of the report are noted
- Auditors are required to gain further clarification and understanding, although not required to be noted in the report
View our expanded knowledge on SSAE 18 via our infographic.