Historical article. Reviewed and corrected October 30, 2026; the original publication date is retained. SSAE 16 is no longer the current standard for a new SOC 1 engagement.
SSAE 16 was part of the transition from SAS 70 to the SOC reporting framework. It addressed reporting on service-organization controls relevant to customers’ financial reporting. Later, SSAE 18 recodified and superseded earlier attestation standards, including SSAE 16. See the AICPA recodification resource.
Which Services Were Relevant?
A customer’s financial-reporting needs determined the relevance of the outsourced service. Payroll processing, loan servicing, or claims processing could involve controls affecting the customer’s financial records. A provider’s industry label alone did not establish the appropriate scope.
For current engagements, the AICPA SOC 1 overview explains the financial-reporting focus. SOC 1 should not be treated as a general certification of every service or a guarantee that the provider will not fail.
Questions That Remain Useful
- Which customer need or contract is driving the request?
- Which services affect the customer’s financial reporting?
- What date or period and report type does the customer need?
- Who owns the relevant processes and evidence?
- Which gaps need to be addressed before the examination?
These questions are more useful than relying on an old minimum price estimate or assuming every organization must obtain a SOC report. Compare proposals using the actual scope, responsibilities, and written terms.
Use Current Guidance for a Current Engagement
References in the original article to SSAE 18 being “on the horizon” described an earlier transition. They should not be read as present planning advice. Current SOC 1 engagements use the applicable attestation standards as amended.
Our SOC preparation checklist provides a practical starting point without the original article’s outdated price assumptions.
28 Responses
I had my internship in an auditing firm. They are very strict when it comes to balancing assets of any company they are handling.
This review is an impediment to smaller companies trying to compete in this industry. The cost of performing an SSAE16 in many instances is larger than the revenue realized from the customers requesting it of the supplier. A smaller company may be focused on one aspect of the entire process, but the SSAE16 makes no accomodation for that possibility. Instead the entire review would need to be done and the report filled in with a lot of DNA's, and then requireing the signature of a CPA that perhaps has never even visited the company.
Really nice job,There are many people searching about that now they will find enough sources, Also looking forward for more tips about that…
Accounts auditor meant a trusty financial recommendation of any corporation from third accounts expert like as auditor or audit organization. By follow this financial recommendation people or shareholders get ensure about their company’s financial condition. In the same way in IT department have needed IT auditing to solve of IT problem like as website technical problem etc.
What does a student have to do to take a position a opportunity for being chosen for an internship in this field? I would be enthusiastic about an chance like that.
“SSAE 16 is an enhancement to the current standard for Reporting on Controls at a Service Organization, the SAS70.”
– yeah right. I do agree with you right then.
Really awesome job,There are many individuals looking about that now they will discover enough resources, Also anticipating for more guidelines about that.
auditing standards have to be a concern for many individuals looking to discover resources and guidelines.
Thank you for updating on new auditing standards. Auditing details do really help in understanding better about finances and tax returns.
I am so happy to read this. This is the kind of SSAE 16 manual that needs to be given and not the random misinformation that’s at the other blogs. Thanks for sharing this.
Great information, very clear and concise! I read it through twice to try sand absorb as much as I could for future reference.
This is of great knowledge for me I just like reading such stuff. Do you have any ideas of what ssae 16 reivew costs?
Based on my own personal experience with SSAE16, I agree with those who say that the cost of implementation will many times…if not always…exceed the possible financial gain from the customer requesting the review. This is a good example of a well intended effort that does not meet the practicality test.
Thanks to a brilliant effort of your part in publishing this article on SSAE 16 reports.
When you say “allowing companies around the world to give you their business with complete confidence,” is that confidence the equivalent of – say – getting a background check performed on a stranger, or more in line with offering accreditation as with the BBB?
Thanks for sharing this very useful information. I’m going to bookmark your site for my future references…
They are maintaining the standard procedure.They can set an example for all. This type is audit is essential in many companies.
SSAE16 auditing gives me more confidence in doing business all over the world
I am a business owner and I am very glad to know your information that you’ve writing about the auditing concerning issue. Which helps me a lot to run my business smoothly. Thanks 🙂
A smaller company may be focused on one aspect of the entire process, but the SSAE16 makes no accomodation for that possibility, I don’t think?
I really respect people who can read those kinds of documents without their eyeballs drying out! Tax is a really useful subject to learn but all this stuff makes me respect auditors and tax lawyers even more.
A top retail trade group executive has called for tougher security standards that could mean more spending for the industry, its banks and business partners after a series of data breaches at major merchants.
Interesting, thanks for letting us know about the Auditing Standard.
Auditing is good for companies it helps them keep accountable.
Great information about the requirements, especially the checklist is handy.
Nice sharing of this good post
I imagine there will be a lot of updates to the laws over the next 5 years.
Companies must apply high standards in their business process outsourcing projects and contracts in order to become reliable and empower their brand’s status online and offline.