SSAE 16 - Applicabilty and performance 3131

    1. Is it necessary to have SSAE16 report for evaluation of controls of Service provider ? Is there another way of evaluation?
    2. Is it necessary to get it done through a CPA firm?

  • A SSAE 16 report must be prepared and issued by a registered CPA firm.
    There are other ways of assessing controls, but they would require you (or your qualified representative) to visit the service provider and perform your own controls assessment. From a service provider perspective, it is generally less intrusive for them to have an SSAE 16 review performed than to have multiple clients come in and perform controls assessments.

Log in to reply