September 28, 2022

Tag Archives: SSAE 16

SOC 1 Report

A SOC 1 Report (System and Organization Controls Report) is a report on Controls at a Service Organization which are relevant to user entities’ internal control over financial reporting. The SOC1 Report is what you would have previously considered to be the standard SAS70 (or SSAE 16), complete with a Type I and Type II reports, but falls under the SSAE 18 guidance (as of May 1, 2017).
Please see the following articles discussing the SSAE 18 guidance and additional information related to the SOC 1 (Type I and Type II) Reports:

Below is a history of key changes made to the audit standard over time to enhance the overall audit and final report.

Differences between SAS 70, SSAE 16 and ISAE 3042:

  1. Management of the Service Organization will be required to provide the service auditor with a written assertion about the following, when performing either a Type I or Type II engagement, which the service auditor will then attest to:
    • The fairness of the presentation of the description of the service organization’s system;
    • The suitability of the design of the controls to achieve the related control objectives stated in the description; and
    • The operating effectiveness of those controls to achieve the related control objectives stated in the description (Type II Only)
  2. During the process of understanding the service organization’s system, the Service Auditor would be required to obtain information that would identify risks that the description of the service organization’s system is not fairly presented or that the control objectives stated in the description were not achieved due to intentional actions by service organization personnel.

SSAE 18 adds an additional set of requirements to further enhance SSAE 16 standard:

  1. Requires the inclusion of a Complementary Subservice Organization Controls section (similar to what is currently required for SOC 2).
  2. Requires the performance of a detailed Risk Assessment based on the control objectives defined in the report.

Remember: Although the reporting standard is soon to be, SSAE 18, the SSAE 16 and ISAE 3204, are all still considered to be a SOC 1 Report!

The latest changes are meant to give the end user a clearer picture of their vendor’s subservice organizations and the responsibilities of the end user as well (Complementary User Entity Controls), which, will help to provide an all around higher level of assurance and understanding to all involved.

SOC 2 and SOC 3 – Additional Reporting Options

In addition to the SOC 1 report which is restricted to controls relevant to an audit of a user entity’s financial statements, the SOC 2 and SOC 3 reports have been created to address controls relevant to operations and compliance.

  • SOC 2 Report – Trust Services Principles – The Service Organization Control (SOC) 2 Report will be performed in accordance with AT 101 and based upon the Trust Services Principles, with the ability to test and report on the design (Type I) and operating (Type II) effectiveness of a service organization’s controls (just like SOC 1 / SSAE 18)….read more
  • SOC 3 Report – WebTrust and SysTrust – The SOC 3 Report is also based upon the Trust Service Principles and performed under AT101, the difference being that a SOC 3 Report is permitted to be freely distributed (general use) and only reports on if the entity has achieved the Trust Services criteria or not (no description of tests and results or opinion on description of the system)….read more

Understanding SaaS Compliance – SSAE 18 / SOC 1 / SOC 2

The software publishing industry has experienced significant growth in the past 5 years and projected to continue at a significant pace (2%-5%) as businesses and consumers increase spending and invest in new technology. software-industry-breakdown-2012

Businesses account for almost 82% of all software related spending with Finance and Insurance leading the pack. Many of the new enterprise software solutions produced now include a SaaS offering (sometimes the sole option), intended to reduce IT overhead / infrastructure compatibility issues and allow more flexible licensing options.

SaaS solutions let a business leave the development and maintenance to the experts and focus on enhancing operations and securing new business. However, these benefits bring additional compliance concerns that software developers and even the end users must concern themselves with as increased oversight and growing demand for industry regulations continue.


Users of SaaS Products in the Enterprise

Businesses are making use of SaaS applications more than ever, but, trusting operations and confidential data with another company can be nerve racking. However, use can also relieve a number of headaches that come with upgrading to the latest software or even worse, developing internally.


  • Reduce the need to hire expensive IT personnel to develop and maintain the software and infrastructure
    • Your developer isn’t the only one with knowledge, so, they cannot hold you hostage!
    • Prevent costly failed development attempts (knowing the business and ability to develop software don’t always align as well as hoped)
  • Reduce IT infrastructure costs (no need to add servers or face compatibility issues)
  • Easier to switch solutions if a better one is available (no infrastructure!)
  • Reduction in compliance issues as controls would be the responsibility of the SaaS provider.


  • Reliance upon another company for business operations and hosting of confidential data.
  • Unable to customize software to business operations as much as an internally developed solutions.
  • Cannot guarantee bug fixes and security vulnerabilities are addressed timely.

So how do you know the application provider is performing their duties appropriately in a controlled, stable, and secured environment? This concern is what SOC 1 (SSAE 16) and SOC 2 seek to address.

SaaS Developers / Providers

Operating a third party hosted solution brings additional responsibility that a software developer didn’t have to be concerned with in saas ssae 16 soc 1 soc 2the past. SaaS providers must be dependable – keeping the system online, functional and secure for your customers that depend on it. To obtain this assurance, many companies require proof that your business has proper controls in place and reviewed by a third party accounting firm. Controls for these services usually are designed based on a combination of security, confidentiality, availability, processing integrity and privacy principles. The appropriate combination will depend upon the product/service offered, level of data confidentiality required, and any customer specific requirements/requests.

Whether you develop software solutions for health care, finance, government or other industry, it is common to see a SOC 1 or SOC 2 as a prerequisite in RFPs. The SOC 2 report is typically the most appropriate for a SaaS solution, but, a SOC 1 (SSAE 16 – now SSAE 18 as of May 1, 2017) is the most requested (although not always the most relevant). The cost for an audit can vary greatly depending on the number of controls, size of the company, and complexity of the IT infrastructure.

From insider scandals to outside threats, the protection of corporate and personal information is the corner stone of information security compliance.  Obtaining a current SOC 1 (SSAE 16/18) or SOC 2 audit report can be a significant differentiator within your industry and provide value to new and current customers.


Contact Skoda Minotti

Please complete the form below to contact Skoda Minotti for additional information and note any relevant information that may help us fulfill your request.

* indicates required field

SOC 1 & SOC 2 Preparation Checklist

I’ve been hearing from various people in the marketplace that they were interested in learning about some steps, at a high level, that they need to take to get off the ground and on their way to completing their SOC 1/2 Report Type I or Type II. So, I will give you all a breakdown of some of the things organizations should be doing now, and some things to think about down the line as you progress.

This SOC Reporting Checklist is geared towards service organizations whom have never undergone a SAS 70, SSAE 16, etc. in the past and will be taking up the task this coming year. A more detailed version geared towards companies that have some experience being audited will be coming down the line.

  • Do your research.
    • You have already come across our site, so you have begun the process of researching SSAE 16 and the responsibilities that come with performing one. I would continue to search for SAS 70 related information as well, as most of that knowledge is applicable.
  • Find a few CPA firms who perform over 75 SOC Reports annually.
    • You will want to research a number of firms that could perform and sign off on your SOC Report, which, only CPA firms are permitted to do. This process should be handled with the utmost care as you are putting a lot of trust into the company you choose, they can make or break you.
    • Some things to consider:
        1. The size of your company – You may not be able to afford a large CPA firm.
        2. The clientele you are attracting – Some companies will not feel secure with the quality of your SSAE 16 if it was performed by a firm that isn’t well known.
        3. Total SOC 1 or SOC 2 reports performed – You do not want to use a company who has never done such work in the past, unless they are comprised of former employees of another quality firm and have decided to take off on their own.
        4. The methodology employed – You will want to quiz the companies and gain comfort around their methods and ensure you are comfortable with their responses and agree based upon your research.
  • Narrow your search.
    • Based upon how you felt about each company, the people, the methodology, their previous experience, and of course, cost,  you should narrow down your search to the top 2 companies.
    • Pricing for a SOC report can vary greatly depending upon the company performing the work, the size of your organization, and audit scope. On average, company’s should be expected to spend between $15,000-$30,000 for a Type II audit.
      • You should look for a fixed rate fee so there is no potential for them to raise rates on you as the project progresses.
  • Define the scope.
    • Once you have engaged a firm to perform the work, make sure you define the scope of the audit early on in the process. Not doing so could lead to excessive delays and potential cost overruns.
  • Define your control objectives and activities.
    • In conjunction with your CPA firm, define the controls and test steps to be tested and make sure that they have been reviewed by process owners and any of the stakeholders at the CPA firm who may be reviewing and/or signing off on the report to ensure everyone is in agreeance. If this isn’t completed prior to testing, you are asking for a world of trouble.
  • Perform a Readiness Assessment.
    • You can either choose to perform a readiness assessment on your own, based upon the test steps already defined, or, if you do not have the capacity or ability to do so internally, you can look towards either the firm performing your review or another firm who is skilled in preparing companies for audits.

These steps laid out here will set you on your way to getting your SSAE 16 started up and going and should help to guide you through the toughest parts of the process. Once you have completed all of the steps we have laid out, you should be able to rely on the knowledge of your CPA firm to take you through the finish line.

If you have any further questions please Contact Us!

This information is also consistent with SSAE-18 which is effective as of May 1, 2017.

Why have an SSAE 16 Review Performed?

Some organizations have heard of SAS 70, SSAE 16, and soon to be SSAE 18, but, don’t really know WHY they need to pay to have a bunch of auditors trounce through their company for a month or two during the year, especially right after their financial audit just finished.
The answer is simple: Many companies will not even think about using your company to perform services for them without a clean Type II Report in place.
Some benefits of having an SSAE 16 performed:

  • Ability to perform outsourcing services for Public Companies.
    • If performing financially significant duties for a Public Company, they are required to use a SSAE 16 qualified provider as it is the only way to give investors assurance over controls that are not performed by the Company in question.
  • Public and Private companies are more likely to trust your organization with their data.
    • If you were to trust a company with your data, you would want complete assurance it will be handled with the utmost care
  • A year round accessible knowledge source (your auditors).
    • As a service organization, large or small, you will always have questions regarding your business and having a set of auditors in place with access to a wide array of business knowledge, it will allow you to bounce your questions and concerns off of a group of trusted individuals.
  • A third party to review your controls and activities to ensure they are functioning appropriately, and give advice on how to improve upon them.
    • Sometimes your internal audit department is good, but, not always as stringent as they should be. This will help to serve as a check on their work, as well as your staff. Additionally, if there were any findings noted, your auditors are in a great position to give you some tricks and tips to improve to ensure everything functions well the following period.
  • Improving performance of the organization.
    • Just the knowledge that a review is being performed of an employee’s work that can have far reaching consequences for the company as a whole. No more, “Oh, I didn’t realize that reviewing user access was THAT important to do this month, sorry”, now, everyone knows that if it’s not done, the success or failure of the organization could rest upon them.

Think of the SSAE 16 or SSAE-18 audit as an annual investment into your company, increasing potential new clients, productivity and accountability.