Transition Blueprint: Navigating from SSAE 18 to the New SSAE 22
SSAE 22 was issued a couple years ago, back in December 2020, to supersede AT-C section 210 with three primary changes, apply to both SOC 1 and SOC 2: Description of the procedures a practitioner may perform in a review engagement: The practitioner is now required to identify areas which a material misstatement could arise, and design and perform procedures to obtain reasonable / limited assurance to support the overall report conclusion, even if it is not a standard analytical test. Some additional permitted testing procedures include: Implications for Service Organizations What does it all mean? Does it matter? For the majority of companies undergoing an audit, the impact of SSAE 22 is minimal. These changes are primarily procedural adjustments that auditors need to make. However, they do set a new standard for transparency and accountability, which can indirectly affect service organizations, especially those with identified audit findings. By understanding these changes, service organizations can better prepare for audits and align their internal controls and compliance measures accordingly.
