SSAE 16, the new attestation standard put forth by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA), will effectively replace Statement on Auditing Standards No. 70 (SAS 70) as the primary standard used for reporting on service organizations. SSAE 16 also has an international equivalent, known as ISAE 3402. In short, both SSAE 16 and ISAE 3402 represent a convergence and adoption of more universally accepted standards for reporting on controls at service organizations. SAS 70, introduced in April of 1992, has had a long, storied, and successful career, to say the least, but change is inevitable.
What’s important to note about SSAE 16, other than the changes it represents from SAS 70, is its willingness (within the ASB of the AICPA) to adopt global standards for reporting on service organizations-a trend that is being played out in many other areas within the accounting industry.
It will be interesting to see how the landscape plays out for SSAE 16 and ISAE 3402 along with the continued reporting on controls at service organizations.