Statement on Standards for Attestation Engagements no. 18 (SSAE 18) is the "attest" standard put forth by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA).
SSAE 18 represents an adoption towards more globally accepted accounting principles. SSAE 18 also brings about a number of requirements. Most importantly that management of the service organization must provide a description of its "system" along with a written statement of assertion. Both of these requirements differ from the previous SOC 1 auditing standard in the following manner:
- The SOC 1 auditing standard only called for a description of "controls", while the SSAE 18 attest standard now requires a description of its "system", which is considered to be more comprehensive and expansive than that of the SOC 1 description of "controls."
- SSAE 18 requires a written statement of assertion, something that was not required under SOC 1 Type I or Type II audits. This written statement of assertion must be crafted by management and contain a number of essential clauses for which management of the service organization will effectively "assert" to. What's important to note is that the written statement of assertion can be included within or attached to the description of the "system."