SSAE 18 - Attestation Standards (SOC Reporting)
AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

SSAE 18 - Attestation Standards (SOC Reporting) 320.23: AT-C 320.23 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement

What does 320.23 require?

The auditor reads any internal audit and regulatory examination reports touching the services and the scope, to understand what work was done and what was found, and uses those findings in assessing risk and in deciding what tests to run, when, and how many.

Maintained by Gerard BlokdykControl text last updated

Other controls in AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls