The AICPA recently announced that the SSAE 18 standard will replace SSAE 16 effective for reports issued on or after May 1, 2017.
Here’s an update for where Cachet Financial Services is with the SSAE 18 audit process and why we will refer to being SOC 1 audited going forward.
SSAE 16 vs. SSAE 18
There are two major changes between SSAE 16 and 18 that relate to Cachet Financial Services:
- Sub-Service Organizations: previously, sub-servicers were supposed to all be SSAE 16 certified as well but, if they weren’t, it could be noted on the audit; now if they aren’t, they will need to be audited as well, or we’ll need to change our relationship with those organizations
- Report Validations: auditors now have more responsibility to verify what they are auditing, which means they need to physically observe operations producing the sample reports for selection rather than just taking our word for it that we’ve provided a full selection for sampling
SOC 1 Clarification
The SSAE 16 standard, aka “Statements on Standards for Attestation Engagements 16, Reporting on Controls at a Service Organization,” is specific to service organizations like Cachet Financial Services. SSAE 18 is for all attestation engagements – i.e. not just service organizations but non-service organizations as well.
This means that SOC 1 is no longer tied to an SSAE designation. In other words, instead of saying that we’re “SSAE 18 SOC 1 audited,” we will refer to being “SOC 1 audited” with the audit having incorporated the new SSAE 18 attestation requirements.
SOC 1 Audit vs. Certification
There is no official SOC 1 certifying body. Instead, audits are conducted by reputable SSAE professionals, often which are CPA firms. When you see references to “certification,” it’s usually synonymous with having been audited and being able to share the auditor’s report.
Cachet SSAE 18 Update
Earlier this month, a team of SSAE consultants have identified what Cachet Financial Services needs to do for a successful SOC 1 audit under the new SSAE 18 attestation requirements, and we are now working on implementing them. We expect to be able to share the audit report by July 1, 2018.
In the meantime, please let us know if you have any questions about SSAE 16 and 18 and the effect on ACH payroll processing, Quantum automated payroll reconciliation, Fedwire transfers, and direct wire services.