SSAE 16 Hosting Services

SAS 70 & SSAE 16 Certification

Connectria has been audited and received SAS 70 Type II Certification and SSAE 16 Type II Certification. SSAE 16 is a new standard designed to replace SAS 70. Both are internationally recognized auditing standards developed by the American Institute of Certified Public Accountants and represent that a service organization has been through an in-depth audit of their control activities, which includes controls over information technology and related processes. SSAE 16 is intended to create a more global, unified standard by more closely aligning the U.S. with international standards.

SSAE 16 Hosting Services

Since April 1992, the U.S. Statement on Auditing Standards No. 70 (SAS 70) has been the leading standard for guidance regarding assurance reports for service organizations. For almost 20 years, service organizations, user organizations and auditors have relied on SAS 70 reports to understand and gain assurance that proper controls relevant to user entities' internal control over financial reporting are in place at service organizations.

Connectria Hosting adheres to SAS 70 standards and has successfully completed SAS 70 Type II Audits for years. Beginning in 2011, however, the SAS 70 standard will be replaced by a newly released standard, SSAE 16 (Statement on Standards for Attestation Engagements No. 16). As with SAS 70, Connectria is SSAE 16 certified.

SSAE 16 was primarily created to:

  • Address the need for a more globalized, uniform standard by more closely aligning US Standards with the International Standard, ISAE 3402 (International Standard on Assurance Engagements 3402).
  • Keep pace with the changing regulations regarding internal control over financial reporting.

The principal differences between the outgoing SAS 70 and incoming SSAE 16 Standards are:

SAS 70 SSAE 16
Management's written assertion is required to accompany auditor's report No Yes
Management's assertion must include the suitable criteria used for its assessment No Yes
Subservice organizations' assertions must accompany the auditor's report even if inclusive method used No Yes
For Type II reports, the opinion on fair presentation of the system and suitability of design is for the period covered by the report (as opposed to a point in time) No Yes

SSAE 16 is expected to deliver tangible benefits to those who utilize the services of an accredited organization. Anyone who obtains a Service Auditor's Report from their service organization(s) receives valuable information regarding the service organization's controls and the effectiveness of those controls. They also receive a detailed description of the service organization's controls and an independent assessment of whether the controls were placed in operation, suitably designed, and operating effectively (in the case of a Type II report).

We are committed to the evolving standards and will continue to demonstrate our compliance, quality of service and assurance so your organization can feel confident in choosing Connectria.

If you'd like to learn more about Connectria Hosting or to Request a Quote on any of our services, please contact us.