SSAE 18 - Attestation Standards (SOC Reporting)
AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

SSAE 18 - Attestation Standards (SOC Reporting) 320.20: AT-C 320.20 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement

What does 320.20 require?

The auditor learns how the system and the in-scope controls work, including how the service organisation drafts the description, sets the control objectives, identifies the controls that meet them, assesses their design and, for a type 2 report, assesses whether they operate effectively.

Maintained by Gerard BlokdykControl text last updated

Other controls in AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls