SSAE 18 - Attestation Standards (SOC Reporting)
AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

SSAE 18 - Attestation Standards (SOC Reporting) 320.28: AT-C 320.28 Obtaining Evidence Regarding the Operating Effectiveness of Controls

What does 320.28 require?

For a type 2 engagement, the auditor tests the controls management identifies and judges whether they worked effectively across the entire period; evidence carried over from earlier engagements does not justify testing less, even if current-period evidence is added to it.

Maintained by Gerard BlokdykControl text last updated

Other controls in AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls