The Statement on Standards for Attestation Engagements (SSAE) is a set of guidelines and requirements that govern how auditors should conduct attestation engagements These standards are important in ensuring the accuracy and reliability of financial statements and other reports that are provided by organizations The most recent update to these standards is SSAE 18, which replaced the previous SSAE 16 standard Understanding the changes in the new SSAE 18 standards is crucial for auditors and organizations alike.
SSAE 18, also known as “Clarification and Recodification,” was issued by the Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA) in May 2017 The new standard became effective for attestation reports issued on or after May 1, 2017 The main goal of SSAE 18 is to provide more guidance and clarity to auditors and to better align with international standards.
One of the major changes in SSAE 18 is the requirement for service organizations to provide a description of their system in the written assertion This description should include the controls that are in place to ensure the accuracy and reliability of the data being processed This change is aimed at improving the transparency and understanding of the service organization’s operations by the auditors.
Additionally, SSAE 18 introduces the concept of “Complementary Subservice Organizations,” which are service organizations that are used by the primary service organization to provide services related to the engagement The primary service organization is now responsible for evaluating and documenting the controls at these subservice organizations This change is important in ensuring the overall effectiveness of the controls in the entire service organization’s environment.
Another significant change in SSAE 18 is the requirement for the auditor to obtain a written assertion from management regarding the suitability of the design and operating effectiveness of controls This written assertion should be provided at the beginning of the engagement and should be signed by management ssae 18. This change is meant to increase the level of accountability and ownership of the controls by the management of the service organization.
Furthermore, SSAE 18 emphasizes the importance of risk assessment in the attestation process Auditors are now required to perform a risk assessment to identify and assess the risks of material misstatement in the system being audited This risk assessment should be based on the auditor’s understanding of the service organization’s environment and the internal controls in place.
In addition to these changes, SSAE 18 also includes new requirements for monitoring and oversight of third-party service providers Service organizations are now required to have processes in place to monitor the performance of third-party service providers and to assess their compliance with the agreed-upon controls This change is important in ensuring the integrity and reliability of the data being processed by third-party service providers.
Overall, the changes introduced in SSAE 18 are aimed at improving the clarity, transparency, and effectiveness of the attestation process By requiring service organizations to provide a detailed description of their systems, evaluate the controls at subservice organizations, obtain a written assertion from management, perform a risk assessment, and monitor third-party service providers, SSAE 18 enhances the reliability and accuracy of attestation engagements.
Auditors and organizations should familiarize themselves with the new requirements and guidelines outlined in SSAE 18 to ensure compliance and to improve the quality of their attestation engagements Adhering to the standards set forth in SSAE 18 will not only enhance the credibility of financial statements and other reports but also provide assurance to stakeholders and customers about the reliability of the information provided.
In conclusion, SSAE 18 brings significant changes to the attestation process, including requirements for service organizations to provide a detailed description of their systems, evaluate controls at subservice organizations, obtain a written assertion from management, perform a risk assessment, and monitor third-party service providers These changes aim to improve the clarity, transparency, and effectiveness of attestation engagements and enhance the reliability of financial statements and other reports Auditors and organizations should be aware of these changes and ensure compliance with the new standards outlined in SSAE 18.