The Important Relationship between ISAE 3402 and SSAE 16

The SSAE 16 "attestation" standard and the ISAE 3402 "assurance" standard essentially share a common framework derived from the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA), which put forth SSAE 16, and the International Auditing and Assurance Standards Board (IAASB) of The International Federation of Accountants (IFAC), which put forth ISAE 3402.

This common framework between SSAE 16 and ISAE 3402 is one that represents a migration, adoption, and ultimately, an acceptance of more globally accepted accounting standards, such as those of the International Financial Reporting Standards (IFRS), which are essentially the standards, interpretations and framework adopted by the International Accounting Standards Board (IASB).

However, it's critical to note that the U.S. Statement on Auditing Standards No. 70, simply known as SAS 70, became the catalyst for what is now known as SSAE 16 and ISAE 3402. Since its inception in April of 1992, the SAS 70 auditing standard quickly became the global de-facto platform used for reporting on controls at service organizations. Sure, there were (and still are) country | region specific standards that could be used, but by and large, the SAS 70 standard was the standard bearer. Thus, the International Auditing and Assurance Standards Board (IAASB) of The International Federation of Accountants (IFAC) decided to develop and put forth an "assurance" standard specifically geared towards reporting on controls at service organizations. As a result, the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) put forth a new "attestation" standard that would closely mirror ISAE 3402. The result? Two new standards and one (SAS 70) which will be effectively replaced after more than 18 years of service.

Please be aware that it's fundamentally important to know that SSAE16 as an "attestation" standard, while ISAE 3402 is an "assurance" standard, and though technically different, they both require management to provide a description of its "system" and a written statement of assertion. The written statement of assertion was never a requirement for SAS 70, and while the SAS 70 standard only called for a description of "controls", both SSAE 16 and ISAE 3402 call for a description of its "system".

So which standard will take front and center? It is simply too early to tell what will happen and which of the two standards (or any remaining country | region specific standards) will take root and become widely used than others.