SSAE stands for the Statement on Standards for Attestation Engagements and No. 18 covers Reporting on Controls at a Service Organization. SSAE 18 replaces the previous SSAE16 Type 2, which itself was a replacement for SAS 70 Type 2 a requirement of the American Institute of Certified Public Accountants (AICPA).

It is important to note that ‘system’ in this case covers the procedures and controls not only the organisation but also the development and hosting infrastructure too. So do please read the SSAE 18 carefully as not all organisations cover the application and hosting.

Our SSAE18 is carried out by Deloitte, the latest available is to end September 2020 is available for download by filling in this form: