SSAE 16 & ISAE 3402 Attestation Services

The Statement on Auditing Standard No. 70 (SAS 70) has been widely used since 1992 when the American Institute of Certified Public Accountants (AICPA) first issued the standard.  As of June 15, 2011, there will be a  new standard that will serve as a SAS 70  replacement. Two standards will be used to replace the SAS 70.  These standards are the SSAE 16, the Statement on Standards for Attestation Engagements No. 16 and the International Standard on Assurance Engagements 3402 (ISAE 3402).  The SSAE 16 was developed by the American Institute of Certified Public Accountants (AICPA) and will be used as the SAS 70 replacement in the United States.  The ISAE 3402 was developed by the International Auditing and Assurance Standards Board (IAASB) and will replace SAS 70 internationally.

As with the SAS 70, the purpose of the two new standards main is to report on the internal controls of service organizations that provide services to different user entities that outsource services to third party providers.  Service organizations will have additional responsibilities with the new standards replacing the SAS 70.  Management will be responsible for preparing a complete and accurate description of the service organization’s system.

Although the new standards are effective for reports with periods ending on or after June 15, 2011, early adoption of the SAS 70 replacements is permitted and actually encouraged.  Early adoption of the standards can be beneficial for organizations.  It will provide more time to plan and ensure the proper implementation of the processes and practices required to comply with the new standards.  Also, service organizations that are early adopters of the standards may be perceived as having a stronger control environment.  They may also be perceived as leaders and may therefore have a competitive advantage.

Enterprise Risk Management (ERM) can assist organizations with the new United States standard, the Statement on Standards for Attestation Engagement 16 (SSAE 16) which was developed by the American Institute of Certified Public Accountants (AICPA).

ERM can also assist organizations with the new international standard, the International Standard on Assurance Engagement 3402 (ISAE 3402) which was created by the International and Assurance Standard Board (IAASB). 

Early adoption is recommended and ERM’s expertise can help client organizations looking to adopt the new standards early.