Statement on Standards for Attestation Engagements 18
A framework for service organization control (SOC) reports that evaluate an organization's information systems relevant to security, availability, processing integrity, confidentiality, and privacy. Includes SOC 1 (financial controls), SOC 2 (security, availability, processing integrity, confidentiality, privacy), and SOC 3 (public version of SOC 2).
| Jurisdiction | Technical Standards |
|---|---|
| Category | Technical Standards |
| Status | Active |
| Latest development |
Analysis
Key Requirements
The Statement on Standards for Attestation Engagements (SSAE) 18 establishes key requirements for service organization control (SOC) reports:
- SOC 1 Reports: Focus on internal controls relevant to financial reporting
- Type I: Evaluates control design at a specific point in time
- Type II: Evaluates control design and operating effectiveness over a period (usually 6-12 months) Source: AICPA SOC 1 Guide
- SOC 2 Reports: Assess controls related to security, availability, processing integrity, confidentiality, and privacy based on the AICPA Trust Services Criteria
- Must include the Security criterion, with others optional
- Type I and Type II reports available, similar to SOC 1 Source: AICPA SOC 2 Guide
- SOC 3 Reports: Publicly available version of SOC 2, with less detail
- Only includes auditor's opinion, not full testing results
- Designed for general distribution without an NDA Source: AICPA SOC 3 Overview
- Management Assertion: Service organization management must provide a written assertion about the fairness of the presentation of the system description and the suitability of control design (and operating effectiveness for Type II) Source: AICPA SSAE 18 Standard
Compliance Challenges
Organizations often face several challenges when implementing SSAE 18:
- Scope Definition: Determining which systems and processes to include in the SOC examination Source: Journal of Accountancy - SOC Reporting Challenges
- Control Documentation: Maintaining comprehensive documentation of control activities and processes Source: ISACA - Common SOC 2 Audit Challenges
- Subservice Organizations: Managing and documenting controls of third-party service providers Source: CPA Journal - SOC Reports and Subservice Organizations
- Continuous Monitoring: Implementing processes to ensure ongoing compliance between audits Source: Deloitte - Continuous Controls Monitoring
Implementation Best Practices
To successfully implement SSAE 18 requirements:
- Conduct a readiness assessment to identify gaps in controls and documentation Source: AICPA SOC Readiness Assessments
- Establish a cross-functional team including IT, security, and business process owners Source: ISACA - Implementing Effective SOC 2 Programs
- Implement a GRC (Governance, Risk, and Compliance) tool to manage controls and evidence Source: Gartner - GRC Tools Market Guide
- Develop a continuous monitoring program to maintain compliance between audits Source: KPMG - Continuous Auditing and Monitoring
Recent Updates
The AICPA has made several updates to the SSAE 18 framework:
- 2018: Updated Trust Services Criteria to align with COSO 2013 Internal Control Framework Source: AICPA Trust Services Criteria
- 2020: Introduced SOC for Supply Chain examination Source: AICPA SOC for Supply Chain
- 2021: Updated guidance on performing and reporting on SOC 2 examinations Source: AICPA SOC 2 Guide 2021 Edition
Related Regulations
SSAE 18 interacts with several other standards and regulations:
- ISO 27001: Information security management standard that overlaps with SOC 2 Security criterion Source: ISO 27001 Overview
- HIPAA: Healthcare privacy regulation with requirements similar to SOC 2 Privacy criterion Source: HHS HIPAA Security Rule
- PCI DSS: Payment card industry standard with controls related to SOC 2 Security and Confidentiality criteria Source: PCI Security Standards Council
Industry Impact
SSAE 18 has significant impacts across various industries:
- Cloud Service Providers: SOC 2 reports are often required by customers to demonstrate security and privacy controls Source: Cloud Security Alliance - Cloud Controls Matrix
- Financial Services: SOC 1 reports are crucial for demonstrating controls over financial reporting Source: FFIEC IT Examination Handbook
- Healthcare Technology: SOC 2 + HIPAA reports provide assurance on both security and privacy controls Source: HITRUST CSF
Sources
- AICPA SOC 1 Guide
- AICPA SOC 2 Guide
- AICPA SOC 3 Overview
- AICPA SSAE 18 Standard
- AICPA Trust Services Criteria
- Journal of Accountancy - SOC Reporting Challenges
- ISACA - Common SOC 2 Audit Challenges
- CPA Journal - SOC Reports and Subservice Organizations
- Deloitte - Continuous Controls Monitoring
- AICPA SOC Readiness Assessments
- ISACA - Implementing Effective SOC 2 Programs
- Gartner - GRC Tools Market Guide
- KPMG - Continuous Auditing and Monitoring
- AICPA SOC for Supply Chain
- AICPA SOC 2 Guide 2021 Edition
- ISO 27001 Overview
- HHS HIPAA Security Rule
- PCI Security Standards Council
- Cloud Security Alliance - Cloud Controls Matrix
- FFIEC IT Examination Handbook
- HITRUST CSF
Recent developments
- — The AICPA Auditing Standards Board issued conforming amendments affecting SSAE Nos. 18, 19, and 21 as part of a broader proposal to update attestation standards for common concepts and sustainability reporting. If finalized, the package would be effective for engagements beginning on or after 2029-06-15.[8] (source)
- — Deloitte reported that the AICPA released an exposure draft proposing amendments to SSAE No. 18 to reflect new common concepts and sustainability-information reporting requirements. The comment deadline was 2026-06-30, indicating the proposal was still open for public feedback within the last three months.[7] (source)
- — The ASB issued an exposure draft proposing major attestation-standard revisions, including changes that would amend SSAE No. 18 alongside related attestation standards. The proposal was positioned as part of a broader modernization effort for examination, review, and sustainability-reporting engagements.[8] (source)
- — The AICPA Auditing Standards Board approved SSAE No. 23, which revises standards including SSAE No. 18 to align attestation guidance with quality management standards. The update changes terminology around “other practitioner” and is effective for engagements beginning on or after 2025-12-15.[9] (source)
- — SSAE No. 18 became effective and superseded most earlier SSAE standards after the AICPA’s attestation clarity project. The standard established the clarified and recodified framework that still underpins current attestation work.[1] (source)
- — Industry commentary on SSAE No. 18 highlighted operational impacts, including required written assertions and written representations in all attestation engagements. The article also noted expanded risk-assessment procedures for examinations and the removal of compilation services from the attestation standards.[6] (source)
- — Service-organization reporting guidance described SSAE 18 as replacing SSAE 16/SAS 70 as the primary standard for controls reporting at service organizations. The change was widely treated as a major compliance and assurance shift for SOC reporting.[2] (source)
- — A technical overview described SSAE 18 as the AICPA standard used by auditors to evaluate and report on service organizations’ internal controls and business processes. It emphasized the standard’s role in aligning controls reporting with broader attestation practices.[3] (source)
Read the full guide to Statement on Standards for Attestation Engagements 18
Related regulations
- Framework Convention on Artificial Intelligence, Human Rights and Democracy — Technical Standards, Active
- OECD Framework for Classifying AI Systems — Technical Standards, Active
- IEEE P7003: Algorithmic Bias Considerations — Technical Standards, Active
- IEEE P2863: Organizational Governance of Artificial Intelligence — Technical Standards, Active
- ISO/IEC 23894: Information Technology — Artificial Intelligence — Risk Management — Technical Standards, Active
- Harmonized Standards for EU AI Act Compliance — Technical Standards, Active
- Development Security Operations Framework — Technical Standards, Active
- Center for Internet Security Critical Security Controls — Technical Standards, Active
Put it into practice
- Generate the policy: ISO 27001 policy generator (generatepolicy.com)
- Buy the policy pack: ISO 27001 Complete Bundle (cyberpolicy.shop)
- Build it yourself: Pillar 01 Companion — The Living ISMS (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates