What SSAE 18 is and why buyers ask for it
SSAE 18 — the Statement on Standards for Attestation Engagements No. 18 — is the auditing standard in the United States for evaluating and reporting on the internal controls of service organisations. Issued by the American Institute of Certified Public Accountants (AICPA), it replaced the earlier SSAE 16 standard and now governs how a SOC 1 examination is conducted and reported.
In practice, when a customer asks a vendor for “an SSAE 18 report,” they are asking for assurance — usually a SOC 1 report — over the controls the vendor operates that touch the customer’s financial data or critical operations. Like the other service-organisation reports in the Cyber Security family, it lets you satisfy many customers and their auditors with one independent examination rather than a stream of individual audits.
What the assessment covers
An SSAE 18 engagement reports on the controls relevant to the service you provide, in two forms:
- Type I — an assessment of the design and implementation of controls at a specific point in time.
- Type II — design and operating effectiveness tested over a period, commonly six months to a year.
A defining feature of SSAE 18 compared with its predecessor is the emphasis on how a service organisation monitors any sub-service organisations it relies on, and on the complementary controls customers are expected to have in place. The engagement is scoped to the control objectives that matter for your service, with readiness work to close gaps before the formal examination.
Typical timeline
A Type I report is typically achievable in around 10–14 weeks depending on how mature your controls already are; a Type II report adds the observation period over which they are tested. As always, the engagement starts with a fixed-price scoping call and a proposal within 24 hours.
Common questions
What is the difference between SSAE 18 and SOC 1?
SSAE 18 is the standard; SOC 1 is the report produced under it. SSAE 18 is the AICPA attestation standard that governs how a SOC 1 examination is performed and reported in the United States. When someone asks for an “SSAE 18 report,” they usually mean a SOC 1 report.
What happened to SSAE 16?
SSAE 18 superseded SSAE 16 in 2017, consolidating and updating the AICPA’s attestation standards. Among other changes it strengthened requirements around the monitoring of sub-service organisations. Reports previously issued under SSAE 16 are now performed under SSAE 18.
What is the difference between a Type I and a Type II report?
A Type I report assesses the design and implementation of controls at a specific point in time. A Type II report assesses design and operating effectiveness over a period — commonly six months to a year. Most clients expect a Type II report.
How does SSAE 18 relate to ISAE 3402?
SSAE 18 governs SOC 1 reports in the US, while ISAE 3402 is the international equivalent issued by the IAASB. Organisations reporting to overseas clients often choose ISAE 3402; those reporting primarily to US audiences use SOC 1 under SSAE 18.
