SSAE 18 - Attestation Standards (SOC Reporting)
AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

SSAE 18 - Attestation Standards (SOC Reporting) 320.29: AT-C 320.29 Obtaining Evidence Regarding the Operating Effectiveness of Controls

What does 320.29 require?

In a type 2 engagement the auditor understands the system changes made during the period; changes user entities and their auditors would consider significant must be in the description or else described in the report with the effect on the opinion determined, and superseded controls relevant to the objectives are tested before the change where possible, with the effect on the report determined where they cannot be.

Maintained by Gerard BlokdykControl text last updated

Other controls in AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls