What is SSAE 18 (formerly SSAE 16)?
SSAE 18 clarified and recodified AICPA attestation standards. It superseded SSAE 16 but covered more than SOC 1.
- November 9, 2026
Menu
FAQ Category: FAQs • SSAE-18
Answers about SSAE 18, its effective date and relationship to SSAE 16, management representation letters and vendor oversight.
Are Third Party Vendor reviews required for SOC 1 and SOC 2?
Review vendors that affect in-scope systems or controls. Assess their evidence, document conclusions, and follow up on issues.
How many updates to SOC 1 have there been?
SSAE numbers are standards, not SOC 1 versions. Use the applicable AT-C standards as amended for current engagements.
Are Representation Letters Required in SSAE 18?
SOC 1 examinations require written management representations. The letter is separate from management’s assertion and other audit evidence.
When is SSAE-18 Effective?
SSAE 18 became effective for practitioners’ reports dated on or after May 1, 2017.
Contact a SOC 1 or SOC 2 Consultant Now
Vulnerability Assessment and Penetration Testing
Get Our Emails
SOC Reporting Guide
Menu
Popular SSAE Resources
Small nonprofits: don’t let one volunteer hold the only keys
Keep donation tools and event systems usable when a volunteer leaves, with simple ownership and handover checks.
SOC 2 User Access Reviews: Decisions, Corrections and Evidence
A practical access-review workflow covering complete populations, accountable decisions, corrections, verification and retained evidence.
SOC 1 Report
Understand when SOC 1 addresses a customer’s financial-reporting needs and which scope, date or period to check.
Your draft SOC 2 report is ready. What should you check?
Check the scope, dates and factual descriptions before the report is issued. Raise evidence-backed corrections without rewriting the auditor’s findings.
A customer wants SOC 2. Can a penetration test help while we wait?
A relevant test may help a customer assess risk before your SOC 2 report is ready. Agree on the evidence and limits without claiming it replaces the audit.
SSAE 18 and SOC 1: What Changed From SSAE 16?
What the historical SSAE 18 transition changed, why SOC 1 remains focused on financial-reporting controls, and how to scope preparation today.