The 10 Required Components of an SSAE 16 System Description

August 30, 2010 Ryan Buckner
All reports on controls at service organizations must be performed in accordance with SSAE 16 and/or ISAE 3402 by June 15, 2011. Because the new standards are heavily based on the existing SAS 70 audit standard, the examination process and resulting report will be very familiar to service organizations that previously completed a SAS 70 audit. However, there is one activity that is likely to be more time consuming than any other during the transition process, which is the conversion of the SAS 70 description of controls to an SSAE 16 “system description”.According to SSAE 16, management’s description of the service organization’s system should identify the services covered by the assessment, the period to which the description relates (or in the case of a type 1 report, the date to which the description relates), the control objectives specified by management or an outside party, the party specifying the control objectives (if not specified by management), and the related controls.The service auditor is required to opine, in part, as to whether management’s system description is “fairly presented”. Paragraph 14 of SSAE 16 provides service auditors with the minimum system description contents that should be present to conclude that a system description is fairly presented. In order to minimize the risk of a fairness of presentation opinion letter qualification, all service organizations should review the list below and verify that their SSAE 16 system description addresses each of the applicable requirements.
  1. The types of services provided to user entities, including, as appropriate, the types of transactions processed.
  2. The procedures, within both automated and manual systems, by which services are provided, including, as appropriate, procedures by which transactions are initiated, authorized, recorded, processed, corrected as necessary, and transferred to the reports and other information prepared for user entities.
  3. The related accounting records, whether electronic or manual, and supporting information involved in initiating, authorizing, recording, processing, and reporting transactions.
  4. The procedures for the correction of incorrect information.
  5. The method of transferring information, including, but not limited to, reports to user entities.
  6. The method that the service organization’s system captures and addresses significant events and conditions other than transactions.
  7. The process used to prepare reports and other information used for user entities.
  8. The specified control objectives and controls designed to achieve those objectives, including as applicable, complementary user entity controls contemplated in the design of the service organization’s controls.
  9. Other aspects of the service organization’s control environment, risk assessment process, information and communication systems (including related business processes), control activities, and monitoring controls that are relevant to the services provided.
  10. In the case of a type 2 report, relevant details of changes to the service organization’s system during the period covered by the description.

It should be noted that SSAE 16 requires the service auditor to determine whether management’s description of the service organization’s system omits or distorts information relevant to the service organization’s system, but acknowledges that management’s description is prepared to meet the needs of a broad range of user entities and their user auditors. Therefore, system descriptions are not required to include every aspect of the service organization’s system that each individual user entity and its user auditor may consider important in its own particular environment. Rather, system descriptions should utilize a “lowest common denominator” approach that presents a level of detail about the system that will be equally applicable to all user entities. Using this approach will ensure that user entities do not misinterpret the applicability of the system description and related controls to the services to which they subscribe.

About the Author

Ryan Buckner

Ryan Buckner is a Principal at Schellman & Company. Ryan currently serves on Schellman’s attestation leadership team and leads the firm-wide research and development for attestation methodology. Ryan is a CIPP, CISSP, CISA, ISO 27001 Lead auditor, and maintains multiple CPA licenses, among other certifications. Ryan is also an AICPA-approved and nationally listed Peer Review Specialist for SOC 1 and SOC 2 examinations. Having completed over 1,000 service audits, Ryan is one of the most experienced service auditors in the world.

More Content by Ryan Buckner
Previous Article
Schellman & Company, Inc. Quoted in CSO Magazine Online
Schellman & Company, Inc. Quoted in CSO Magazine Online

Chris Schellman, President and Shareholder at Schellman & Company, Inc. was quoted in Bill Brenner's articl...

Next Article
SSAE 16 Web Content Launched
SSAE 16 Web Content Launched

Schellman & Company, Inc. is pleased to launch new content on our website for SSAE 16. The new content incl...


First Name
Error - something went wrong!