SSAE 16 | Reports | Audits |New York, Buffalo, Rochester, Albany, NYC

SSAE 16 - services organization reporting standards

Freed Maxick provides SSAE 16 services to companies in New York and across the U.S. The prevalence of SAS 70 audits has grown dramatically since the standards issuance in April of 1992. The importance of the standard cannot be understated in the value it has provided, serving the needs of service providers, user organizations and user auditors to report on the effectiveness of service organizations’ internal controls.

Major changes effective June 15, 2011:

1. More detailed requirements for the description of the service organization’s system of controls.
2. Adds a written assertion from management.
3. Adds a risk analysis.
4. Increases clarity and reporting requirements for the use of subservice organizations.
5. Changes auditor opinion on control design effectiveness from a single date to the entire period of time covered by the report.

Service organizations of all sizes have demonstrated their commitment to internal controls by proactively obtaining a Service Auditor’s Report. However, the increasing importance of effective controls and reporting processes, combined with globalization and regulatory concerns, have prompted the issuance of a new standard that replaces SAS 70 for US based service organizations.

How will the new standard affect my business?
How do I prepare to meet the new requirements?

In April 2010, the American Institute of Certified Public Accountants (AICPA) Auditing Standards Board issued Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization. SSAE 16 supersedes Statement on Auditing Standards No. 70, Service Organizations (SAS 70). SSAE 16 is applicable when an entity (the user entity) outsources a business task or function to another entity (the service organization) and the data resulting from that task or function is incorporated in the user entity’s financial statements. For example, if a health insurance company outsources its medical claims processing, and the resulting claims data is used to record its claims expense and related liability, the insurance company is responsible for the accuracy of the data even though the data is generated by the claims processor. 

While similar to SAS 70, the new SSAE will require changes to service organizations’ reports and reporting processes. For some service organizations, these changes will be relatively minor. For others, significant efforts will be required to change their reports, reporting processes or both. To determine the impact of and how best to plan for implementation of the new standards, service organizations need to understand the following:

• Reasons for the new SSAE and timing
• Service organization responsibilities under the new SSAE
• Action steps to implement the new SSAE

 Download more information on SAS 70 Evolution: Here Comes SSAE 16

Freed Maxick & Battaglia, CPAs is Western and Upstate New York's (NY) largest public accounting firm and a Top 100 firm in the U.S. Freed Maxick provides, audit, tax and consulting services to private and public (SEC) companies in Buffalo, Rochester, Syracuse and Albany New York. Freed Maxick has vast national and international resources to help your business expand nationally and internationally.

Contact Larry Hessney Via the Web




Larry Hessney, CIA, CISA