SSAE 18 - Attestation Standards (SOC Reporting) 320.15: AT-C 320.15 Assessing the Suitability of the Criteria

For a fair description, the criteria require as a minimum that it shows how the system has been designed and put in place, covering: the services and the kinds of transactions handled; the manual and automated steps through which transactions are started, authorised, recorded, processed, corrected and reported; the records and information relied on; how significant events that are not transactions are captured; how reports for user entities are produced; any subservice organisation and whether it is carved out or included; the control objectives and the controls meeting them, complementary user entity and subservice organisation controls included; and the remaining relevant parts of monitoring, control activities, information and communication, risk assessment and the control environment. For a type 2 report it also covers relevant changes during the period. Nothing relevant may be left out or distorted, while accepting that the description serves the shared needs of many different users rather than each user's specific needs.