SSAE 18 Explained: The Attestation Standards and Which Sections Still Apply

SSAE No. 18, Attestation Standards: Clarification and Recodification, was issued by the AICPA Auditing Standards Board in April 2016. It restructured the attestation standards into the AT-C sections that CPAs still cite, in the same way the clarity project restructured auditing standards into AU-C. It applied to practitioners' reports dated on or after May 1, 2017.

Search results for "SSAE 18" are crowded with compliance-software pages that treat it as a SOC 1 label. It is wider than that. SSAE 18 is the framework for examination, review and agreed-upon-procedures engagements, and SOC 1 is one examination built on it. Several of its sections have since been replaced. This page shows what SSAE 18 introduced, what later statements changed, and how to tell which AT-C section governs an engagement today.

This page paraphrases the standards. Read the AT-C sections in AICPA Professional Standards for the full text.

What is an attestation engagement?

In an attestation engagement a practitioner issues a report on subject matter, or on an assertion about subject matter, that is the responsibility of another party. The subject matter can be financial or nonfinancial, for example a service organization's controls, a compliance obligation, a sustainability metric or prospective financial information. The practitioner measures or evaluates it against criteria and reports a conclusion.

That differs from an audit of historical financial statements under GAAS. Audits follow AU-C. Everything else that attests to subject matter follows AT-C, with AT-C 105 as the common base and the other sections adding engagement-specific requirements.

What did SSAE 18 introduce?

SSAE 18 produced a set of AT-C sections:

The three assurance levels are examination (reasonable assurance, a positive opinion), review (limited assurance, a conclusion), and agreed-upon procedures (no assurance, findings only). AT-C 105 sets what a practitioner must establish before accepting any of them: independence where it is required, suitable and available criteria, a responsible party, and the ability to obtain sufficient appropriate evidence.

Which SSAE 18 sections have been replaced?

SSAE 18 is the base, but five later statements changed parts of it. Read the current AT-C text, not the 2016 version.

AT-C 205, the examination section, remains the core standard for SOC 2, SOC 3 and most other examinations, with the Trust Services Criteria or other criteria supplying the measurement basis. AT-C 320 remains the SOC 1 standard.

How do SOC reports fit in?

A SOC engagement is an attestation engagement under AT-C:

• SOC 1 is an examination under AT-C 320 of a service organization's controls relevant to user entities' internal control over financial reporting. User auditors use it under AU-C 402.
• SOC 2 is an examination under AT-C 205 of controls relevant to security, availability, processing integrity, confidentiality or privacy, measured against the Trust Services Criteria.
• SOC 3 is the general-use report from the same type of examination. See SOC 3 reports.
• SOC for Cybersecurity is an examination of an entity's cybersecurity risk management program against the description criteria.

For a CPA firm the practical point is that SOC work is attest work. It needs independence from the client where the standards require it, a documented engagement acceptance under AT-C 105, and sufficient appropriate evidence for the opinion.

What does the standard change in practice?

For a firm that already performs SOC or AUP work, SSAE 18 is old news. The live questions are about which version applies:

1. Pull the current section for the engagement type. A review engagement is AT-C 210 as replaced by SSAE 22, and an AUP engagement is AT-C 215 as replaced by SSAE 19. Templates built in 2017 may predate those.
2. Use the right opinion level. An examination gives a positive opinion. A review concludes with limited assurance. Agreed-upon procedures report findings and no assurance. Engagement letters and reports that mix the levels create liability.
3. Document acceptance. Criteria suitability, responsible party and independence are conditions of acceptance. The report carries a statement about independence.
4. Plan for SSAE 23. Attestation engagements beginning on or after December 15, 2025 sit under the firm's quality management system. See SQMS 1 and SAS 146 for the audit equivalent.

Frequently asked questions

Is SSAE 18 the same as SOC 1?

No. SSAE 18 is the full set of attestation standards. SOC 1 is one engagement type, an examination under AT-C 320, that SSAE 18 created from the older SSAE 16 approach.

Is SSAE 18 still in effect?

SSAE 18 established the AT-C framework and its common sections, notably AT-C 105 and AT-C 205, remain the base. Later statements replaced AT-C 215 and AT-C 210 and amended others, so the current AT-C text controls.

What did SSAE 18 replace?

It recodified the earlier attestation standards, including SSAE 16, which had replaced SAS 70 for service organization reports.

Does an attestation engagement require independence?

Yes where the standards call for it. Examinations and reviews require the practitioner to be independent under the AICPA Code, and so do agreed-upon-procedures engagements, whose reports include a statement about independence.

Sources

• AICPA Auditing Standards Board, SSAE No. 18, Attestation Standards: Clarification and Recodification (April 2016)
• AICPA, SSAE Nos. 19, 20, 21, 22 and 23; reported in Journal of Accountancy, "AICPA auditing standard on scope of review engagements" (December 2020) and Deloitte DART, "AICPA issues revised review engagements standard" (December 2020)
• AICPA Professional Standards, AT-C sections 105, 205, 206, 210, 215, 320

Related

• Agreed-upon procedures engagements
• SOC 1 reports and AU-C 402
• SOC 1 report glossary
• SOC 2 report glossary
• Examination engagement
• SOC 2 readiness checklist

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error