FAQ’s

Q. — Why was the guidance for service auditors moved from the SASs (auditing standards) to the SSAEs (attestation standards)?

A. —The SASs primarily provide guidance on reporting on an audit of financial statements; whereas, the SSAEs primarily provide guidance on reporting on other subject matter. In a service auditor’s engagement, a CPA reports on a service organization’s description of its system and on the service organization’s controls that are relevant to user entities’ financial statements. Because an examination of a description of a system and controls is not an audit of financial statements, the ASB concluded that the new standard should be placed in the attestation standards along with SSAE 15, An Examination of an Entity’s Internal Control Over Financial Reporting That Is Integrated With an Audit of Its Financial Statements, in which a CPA reports on an entity’s controls over financial reporting. SSAE 16 is a product of the ASB’s project to clarify its standards and to converge with standards of the International Auditing and Assurance Standards Board (IAASB). The IAASB’s standard for service auditors is included in its assurance standards (the equivalent of the attestation standards). Accordingly, the guidance for service auditors was moved to the attestation standards.

Q. — Will the guidance for user auditors change and will it remain in the auditing standards?

A. — The guidance for user auditors, currently in AU section 324 of the SASs, will be unchanged until the new SAS for user auditors, already approved by the ASB, becomes effective. The new SAS does not contain any significant changes for user auditors. However, the ASB believes that because the new SAS is written in clarity format, it will be easier for user auditors to use and thereby meet their responsibilities. The new guidance for user auditors will remain in the SASs.

Q. — When will the new standards become effective?

A. — SSAE 16 is effective for service auditor’s reports for periods ending on or after June 15, 2011, with earlier implementation permitted. This is the same effective date as the effective date of the IAASB’s standard for service auditors. The new clarified SAS for user auditors Audit Considerations Relating to an Entity Using a Service Organization will have the same effective date as the other ASB clarified SASs.

Q. — During the period after SSAE 16 becomes effective and before the new clarified SAS for user auditors becomes effective, will the guidance for service auditors that is currently in AU section 324 be deleted?

A. — No. The guidance for service auditors and user auditors currently in AU Section 324 is so intertwined that if the guidance for service auditors were deleted, the guidance for user auditors would not be meaningful. During the interim period before the new SAS for user auditors becomes effective, a notation will be placed at the beginning of AU Section 324 informing readers that the guidance for service auditors has been superseded by SSAE 16. The guidance for user auditors can be gleaned without deleting the guidance for service auditors.

Q. — Should service organizations use an SSAE 16 service auditor’s report to market their services to potential customers?

A. — No. The nature of the services performed at a service organization, how they are performed, and the controls over those services differ for each service organization. A service auditor’s report only addresses controls that the service organization believes would be relevant to clients of the service organization and their user auditors. Therefore, a service auditor’s report provides useful information only to a user organization that actually uses those services and needs that information to make decisions about its own internal control over financial reporting. As a result, use of an SSAE 16 report (as with a SAS 70 report) is restricted to user entities that are customers of the service organization and user auditors. An SSAE 16 report is not intended to be used as a marketing or sales tool by the client.