SSAE 18 - Attestation Standards (SOC Reporting)
AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

SSAE 18 - Attestation Standards (SOC Reporting) 320.27: AT-C 320.27 Obtaining Evidence Regarding the Design of Controls

What does 320.27 require?

The auditor judges whether the controls management identifies as meeting the control objectives are suitably designed by: learning how management finds and assesses the risks that threaten those objectives and checking that this identification is complete and accurate; assessing how the controls tie to those risks, covering the risks that every kind of transaction brings and IT-related risks to user entities' financial reporting; and confirming that the controls are actually in place.

Maintained by Gerard BlokdykControl text last updated

Other controls in AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls