Statements on Standards for Attestation Engagements No. 16, commonly abbreviated as SSAE 16 is the new standard for reporting on controls at service organizations, essentially replacing American Institute of Certified Public Accountants (AICPA) Statement on Auditing Standards no. 70, simply known as SAS 70.  SSAE 16 verifies that the controls and processes set in place by a data center are actually followed, and  also requires verification of design and operating effectiveness. SSAE 16 goes beyond SAS 70 by requiring an auditor to obtain a written assertion from management regarding the design and operating effectiveness of the controls being reviewed.  SSAE 16 also provides better alignment with the international audit standard ISAE 3402.

The AICPA’s reporting framework, known as  Service Organization Control Reports SM, was developed in 2011 and consists of three major document types. The first – the SOC 1 SM report - deals with controls over financial reporting, and replaces the widely used SAS 70 report. The SOC 2 SM  report, meanwhile, focuses on controls that bear on a service provider’s security, processing integrity and operating availability, as well as the confidentiality and privacy of data moving through its systems. A third report, SOC 3 SM, is a compressed version of the SOC 2 SM  and is designed for public distribution.