SSAE 18 - Attestation Standards (SOC Reporting) 205.89: AT-C 205.89 Documentation

What does 205.89 require?

The documentation is detailed enough to show what procedures were performed under the AT-C sections and applicable law, when, and how extensively, including: the features identifying the items tested; who did the work and on what date; significant discussions held with the responsible party or other people; matters that arose where representations were refused, unreliable or only oral; and who reviewed the work and on what date. It also records the results and the evidence gathered, and the significant findings, the conclusions and the significant judgements the practitioner made.