Instructor for this course

In April 2016, the American Institute of Certified Public Accountants (AICPA) Auditing Standards Board (ASB) issued the Statement on Standards for Attestation Engagements (SSAE) No. 18, Attestation Standards: Clarification and Recodification, to supersede the former standard SSAE 16.

This course will help you if your organization has the need to obtain or provide a SOC (Service Organization Control) report or if you wonder what changes the new SSAE 18 standard will bring to the process. SSAE 18 is effective for SOC report opinions dated on or after May 1, 2017 and early adoption is permitted. This course focuses on the specific requirements of SSAE18 and highlights changes from SSAE16.

In today’s economic environment, many companies utilize outsourced services to perform varied functions.  These functions can span from payroll and accounts payable to information technology processes or even call center functions.  The list can be endless however these services are often a critical component to the internal control environment of the organization.

A service organization should implement a robust third party vendor management policy, if one is not already in place. Often, initial vetting occurs of the subservice organization however that same diligence is not maintained as the service continues.  It is just as important to ensure that subservice organizations are monitored on an ongoing basis using the methods outlined in SSAE 18. 

Course Series

This course is included in the following series:

2 CoursesAll About SSAE 18

  1. Service Organization Control Reports under SSAE18
  2. Understanding the Requirements of SSAE18

Learning Objectives

  • Explore the requirements of Statement on Standards for Attestation Engagements (SSAE) No. 16
  • Explore the impetus of SSAE 18
  • Discover the meaning of subservice organizations.
  • Recognize specific changes related to monitoring controls at sub-service organizations
  • Discover the concept of a more detailed risk assessment for subservice organizations
  • Discover the concept and requirements of complementary controls
  • Explore the modification to assertion criteria and written assertion
  • Explore the need for evidence provided by service organizations
Last updated/reviewed: October 18, 2018

10 Reviews (37 ratings)Reviews

Member's Profile
I thought the content did a great job in explaining all of the different aspects of SSAE 18. The content was in-depth enough to obtain a further understanding and provide an individual with the baseline knowledge of what SSAE 18 is. I think this course would be great for anyone who has some background knowledge around SOC and is interested in obtaining a better understanding.
Member's Profile
The instructor clearly defined SSAE 18. She made the information easy to understand. This course is so helpful. I've been reading SOC 2 book from AICPA and it's dry. The course isn't dry, which makes it easy to get through.
Member's Profile
My knowledge on the requirements of SSAE18 has been gone to a very higher level. Thanks for the crisp but detailed explanation on the SSAE journey. Hats off to the trainer.
Anonymous Author
Another well presented course from the familiar office of Lynn Fountain. Excellent overview of the standard for those not familiar with this guidance.
Anonymous Author
Took Lynn's other two courses on this subject, some stuff overlaps but each provide additional detail the others did not, very infomative
Member's Profile
This course was on a topic I had no prior knowledge on but Lynn presented the material in a clear and understandable manner.
Member's Profile
Understood the content and was very helpful. The explanation of the material presented was really easy follow.
Anonymous Author
I was looking for a little more on how management uses SOC reports, but this is a good overview.
Member's Profile
Very informative and Lynn has clearly stated the difference between SSAE 16 and SSAE 18.
Member's Profile
Good that this is a separate course from the SOC Reports course


Course Complexity: Intermediate

No advanced preparation or prerequisites are required for this course. It may be helpful to view the course Service Organization Control Reports under SSAE18 prior to taking this course. 

Education Provider Information

Illumeo, Inc., 75 East Santa Clara St., Suite 1215, San Jose, CA 95113
For more information regarding this course, including complaint and cancellation policies, please contact our offices at (408) 400- 3993 or send an e-mail to .
Course Syllabus
  3:20Introduction to Understanding the Requirements of SSAE18
The Requirements of SSAE18
  5:29SSAE 18 Intent
  6:47Impact of Change
  2:41Subservice Organization
  5:06Modifications of SSAE 18
  4:06Risk Assessment
  3:44Complimentary Controls
  43:32Understanding the Requirements of SSAE18
  PDFSlides: Understanding the Requirements of SSAE18
  PDFUnderstanding the Requirements of SSAE18 Glossary/Index