The Statement on Standards for Attestation Engagements (SSAE) No. 16, effectively replaced the former standard SAS 70 in 2010 as the authoritative guidance for reporting on controls at service organizations. Today, many service organizations have converted to the new standard and now have a SSAE 16 report, also referred to as a Service Organization Controls (SOC) 1 report.
This course provides an overview of SSAE 16 standards and the approach to compliance reporting on controls at service organizations as well as the responsibilities of those organizations being audited. We also discuss:
- Outsourcing and risk
- Terms and definitions
- Why SAS 70 was replaced with SSAE 16, and the key differences between the two
You also learn about the three SOC reporting options and two types of reports, with emphasis on the SOC 1 report. Also covered:
- Various sections of SOC 1
- How to write a description of a service organizations control environment, as well as managements written assertion
- How to derive value from the reports to evaluate service organizations services
Learning Objectives
- Discover and differentiate between the three types of SOC reports
- Identify and name the components of a SOC 1 report
- Discover and compose a management assertion letter to include with the service auditor’s opinion
- Recognize and effectively describe the service organization’s “system”
31 Reviews (120 ratings)
Prerequisites
Prerequisite: Overview of service organizations
Advanced Preparation: None