Are your US-based clients or international corporations requesting a SOC report and asking about SSAE 18 compliance?
SSAE 18 (Statement on Standards for Attestation Engagements No. 18) is the AICPA standard for attestation engagements in the United States.
It forms the basis for SOC 1 and SOC 2 reports and replaced its predecessor, SSAE 16, in 2017.
On this page, you will learn what SSAE 18 regulates, how it relates to ISAE 3402 and ISAE 3000, and which report is the right one for you.
%20(15).png)
Digital workflows and reusable evidence reduce manual effort – especially during re-certification.
Numerous completed audit and assessment projects form the basis of our methodology.
SaaS providers, cloud platforms, IT service providers, and regulated companies rely on Certinova
SSAE 18 is not a product in itself, but rather the framework upon which AICPA SOC reports are based. Which report is right for you depends on your clients and their requirements.
.svg)
The standard defines how an independent auditor (CPA) assesses management's assertions about controls and systems. It includes, among other things, sections AT-C 105 and 205 as general foundations, as well as AT-C 320 for controls related to financial reporting.
.svg)
SOC 1 assesses controls relevant to client financial reporting and is based on SSAE 18 (AT-C 320). The international counterpart is ISAE 3402, and the German equivalent is IDW PS 951.
Find more information on SOC 1 here.
.svg)
SOC 2 assesses controls related to security, availability, processing integrity, confidentiality, and privacy based on the Trust Services Criteria. In the USA, it is prepared according to SSAE 18, and internationally, it is often prepared according to ISAE 3000.
Find out more about SOC 2 here.
.svg)
As with ISAE 3402, Type 1 assesses the suitability of controls as of a specific date. Type 2 additionally assesses their operating effectiveness over a period of time, typically six to twelve months.
We combine professional assessment by experienced auditors with technology-driven processes.
The result: shorter audit cycles, less internal effort for you, and reports that meet your customers' requirements.
Evidence is collected in a structured manner and automatically validated – the professional assessment remains with our auditors.
Submit documents, answer questionnaires, track status—transparent instead of endless email chains.
A clear audit pattern from scope to report—fewer follow-up questions, predictable effort.
An experienced team supports you beyond the individual report—including follow-up audits and related frameworks.
From the distinction between ISAE 3402 and ISAE 3000 to the question of which report your clients will accept: you will find the most important answers here.
Can't find your question? Please contact us directly.
Both standards pursue the same goal for controls related to financial reporting. SSAE 18 comes from the AICPA and applies in the USA, while ISAE 3402 comes from the IAASB and is internationally oriented. In practice, they are closely aligned. With proper scoping, a single report can cover both standards.
This includes SOC 1 and SOC 2 in the US version. SOC 3 is a publicly available summary of SOC 2. The specific set of criteria, such as the Trust Services Criteria, determines the content.
Not necessarily. For clients in Germany, IDW PS 951 or ISAE 3402 is usually the appropriate basis. If you have international or US-based clients who explicitly require a SOC report, a report according to SSAE 18 or a combined audit is advisable.
Let's get in touch to discuss your requirements.
