IT Examiner School, Providence, RI

External Technology Service Provider (TSP) Reviews

• Additional reports examiners may see when reviewing a financial institution’s vendor management program: – SSAE 18 – SOC Reports

SSAE 18

• One of the most common types of audits that you will see is a Statement for Attestation Engagements (SSAE) No. 18 audit.

• AICPA has replaced the audit standard known as SSAE 16 for reports on or after May 2017. You may hear bankers or other examiners still refer to the report as SSAE 16 or even Statement on Auditing Standards (SAS) No. 70 audits.