What are SSAE No. 18s and How Do I Use Them?

All Reporting Entities engage Service Organizations to perform services on their behalf, such as processing payroll. Service Organizations that want to provide their customers (and their auditors) with a level of assurance that they have strong internal controls in place over the services they provide for their customers hire auditors to perform a Statements on Standards for Attestation Engagements (SSAE) No. 18 examination. The examination results in a System and Organization Controls (SOC) report. These reports summarize the processes and controls in place to completely and accurately process transactions on customers’ behalf. For example, the Defense Finance and Accounting Service (DFAS) has an SSAE No. 18 report over the systems and processes it uses to process civilian payroll for its customers.