FAQ: Are Representation Letters Required in SSAE 18?

Yes. For SOC 1 examinations, the applicable AT-C requirements call for management’s written representations. This was not entirely new with SSAE 18: SSAE 16, codified in former AT section 801, already addressed written representations and a representation letter. The letter is separate from management’s assertion included with the system description and does not replace the auditor’s other evidence. Confirm the required content and signing arrangements with the CPA firm.

Additional FAQs

Who should own SOC 2 controls in a small company?

Assign ownership to the person who can actually make the process work. HR may own onboarding records, engineering may own deployment approvals, and a business leader may own risk decisions.

How can we spot AI being added to a product we already use?

Have the product owner check for AI changes in: Ask the vendor and internal users whether AI has been added, whether it is enabled by default, and what information it

What controls matter when an AI agent can take actions?

Start by limiting the actions the agent is allowed to take and the systems it can reach. Use an identifiable account, narrow permissions, and approval steps for sensitive or difficult-to-reverse

We have a SOC 2. How much effort is GDPR?

Estimate the extra effort by mapping the personal-data activities and GDPR obligations that apply, then comparing them with your existing controls and evidence. Sort the gaps into three groups: already

What should happen when an evidence integration stops working?

Make the failure visible and assign an owner to resolve it. Record the affected systems, the last successful collection, the missing period, and whether the underlying control continued operating. Use

Which SOC 2 tasks should we automate first?

Start with repetitive collection or reminders where the inputs and expected result are well understood. Examples include scheduling evidence requests, exporting an approved report, or flagging an overdue review. Document

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide