SSAE No. 18
SSAE 18: the statement that rebuilt the attestation standards.
Statement on Standards for Attestation Engagements No. 18, Attestation Standards: Clarification and Recodification, rewrote the AICPA's attestation standards, which now appear as the AT-C sections. It is not a SOC report, a certificate or a set of controls. It is the rulebook the CPA firm follows.
Back to SOC 2 services01 · What it is
A statement, not a framework
SSAEs are issued by the AICPA's Auditing Standards Board; No. 18 is the base of today's set.
- Statement number
- No. 18
- Attestation Standards: Clarification and Recodification
- New section prefix
- AT-C
- Replacing the older AT sections
- Effective date
- 1 May 2017
- For practitioners' reports dated on or after this date
SSAE 18 completed the ASB's attestation clarity project. It recodified and superseded SSAE Nos. 10 to 17, with a few exceptions that were kept: the older section on an examination of internal control integrated with a financial statement audit, and the section on Management's Discussion and Analysis.
02 · Why recodify
Why the standards were rewritten
Clarity, consistency and a structure built around level of service and subject matter.
- The ASB was concerned about the clarity, length and complexity of the old standards.
- Each section was redrafted in one format: objectives, definitions, requirements, then application material.
- Requirements became easier to tell apart from guidance.
- The sections were regrouped so the one that applies depends on the level of service and the subject matter.
- 100Common conceptsAT-C 105, applying to every engagement.
- 200Level of serviceExamination, review, agreed-upon procedures.
- 300Subject matterSpecific subjects, including AT-C 320 for SOC 1.
03 · Service organizations
What SSAE 18 brought to service organization reports
Most changes landed in SOC 1 through AT-C 320, and shaped SOC 2 practice too.
- Complementary subservice organization controls. Under a carve-out, the description identifies the controls the design assumes a vendor performs.
- Monitoring of subservice organizations. Service auditors look at how management monitors its vendors, not only at whom it uses.
- Risk assessment. The examiner identifies and assesses risks of material misstatement and plans procedures in response.
- Information produced by the organization. The examiner considers whether reports and lists used as evidence are complete and accurate.
- A written assertion with the report. Management's assertion is a required part of the report package.
Read this list as a practical summary. The exact requirements are in AT-C 320, the attestation standards it rests on, and the AICPA SOC guides.
04 · SSAE 16 to 18
How SSAE 18 replaced SSAE 16
The SOC 1 standard moved from one stand-alone statement into the AT-C framework.
Before: SSAE 16
- A stand-alone statement for service organization reports
- Itself the successor to SAS 70
- Codified in the older AT sections
After: SSAE 18
- Service organization reporting folded into AT-C 320
- Common concepts and examination steps moved to AT-C 105 and 205
- One consistent format across all attestation work
A SOC report today that cites SSAE 16 as its standard is out of date.
05 · What came after
The statements that amended SSAE 18
SSAE 18 is still the base. Later statements amend or replace sections of it.
| Statement | What it did | Effect on SOC 2 |
|---|---|---|
| SSAE 19 | Replaced AT-C 215, agreed-upon procedures; an assertion from the responsible party is no longer required for AUP | None directly |
| SSAE 20 | Changed how materiality is described in AT-C 205 and 210 | Shapes how the examiner judges what matters |
| SSAE 21 | Added AT-C 206, direct examinations, and revised assertion-based examinations | SOC 2 stays assertion-based under AT-C 205 |
| SSAE 22 | Replaced AT-C 210, review engagements | None directly |
| SSAE 23 | Brought the standards in line with AICPA quality management; applies to engagements starting 15 December 2025 or later | Affects the CPA firm's quality system and its use of other practitioners |
In 2026 the ASB exposed a broader revision of AT-C 105, 205 and 210, conforming changes to other sections including AT-C 320, and new sustainability sections. These are proposals. If finalized as drafted, they would apply to engagements from 15 June 2029 onward.
06 · Saying it right
How to refer to SSAE 18 accurately
Common phrases that misdescribe the standard.
- “SSAE 18 certified”. No one is certified to an attestation standard. A CPA firm issues a report under it.
- “SSAE 18 audit” for a SOC 2. Accurate enough, but what a SOC 2 really involves is an examination under the attestation standards, judged against the Trust Services Criteria.
- “SSAE 21 replaced SSAE 18”. It amended part of it. SSAE 18 as amended remains the base.
- Listing SSAE 18 as a security framework. It contains no controls. The controls are yours; the criteria are TSP 100.
Sources: AICPA SSAE No. 18, Attestation Standards: Clarification and Recodification; AICPA SSAE Nos. 19 to 23 summary pages; AICPA “SSAEs currently effective” page; Journal of Accountancy reporting on SSAE 18 (April 2016), SSAE 19, SSAE 23 (May 2024) and the 2026 exposure drafts.
Questions about SSAE 18
Is our SOC 2 performed under SSAE 18?
Under the attestation standards SSAE 18 created, as amended.
The work follows AT-C 105 and 205, which SSAE 18 codified and later statements amended. The criteria are TSP 100 and DC 200.
Do we need to do anything because SSAE 18 changed?
Not now. The change took effect in 2017.
Any current SOC report is already under the recodified standards. What matters for you is the vendor monitoring and complementary controls your description discloses.
Will there be an SSAE that replaces SSAE 18?
Revisions are proposed, not issued.
The ASB's 2026 exposure drafts would revise several AT-C sections and, if finalized, start with engagements from 15 June 2029. Watch the AICPA's announcements rather than vendor blogs.
Is ISAE 3402 the same as SSAE 18?
No. It is the international standard for SOC 1-type reports.
ISAE 3402 is issued by the IAASB. Some reports are prepared to meet both so one examination serves US and international user auditors.
Describe your report in the right words.
We review your sales and trust-page wording so it says what your report actually is.