While working with clients to scope their SSAE 16 engagements, many a times we are asked what is the minimum coverage period for a Type 2 SSAE 16 examination. Let me try and answer that questions and draw some clarity to it.
The SSAE 16 standards require a minimum of a six month reporting period. Paragraph A42 of Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization (AICPA, Professional Standards, AT sec. 801), states that a type 2 report that covers a period of less than six months is unlikely to be useful to user entities and their auditors.
The Audit Guide dated May 1, 2011 provides some additional guidance around this. More specifically, in evaluating the appropriateness of the period covered by of the tests of controls, the user auditor must keep in mind that the shorter the period covered by a specific test and the longer the time elapsed since the performance of the test, the less evidence the test may provide. For example, a report on a six-month testing period that covers only one or two months of the user entity’s financial reporting period offers less support than a report in which the testing covers six months of the user entity’s financial reporting period.
If your report covers a minimum period of six months of your client’s fiscal year, you would be in compliance with the standard and the related guidance issued by the AICPA. For the balance period not covered by your report, you may issue a ‘bridge letter’ that states that there are no changes to the controls and no exceptions that management is aware of.
Should any of you need further guidance on this topic or wish to discuss it further, please feel free to contact me.