SSAE 18 - Attestation Standards (SOC Reporting)
AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

SSAE 18 - Attestation Standards (SOC Reporting) 320.32: AT-C 320.32 Obtaining Evidence Regarding the Operating Effectiveness of Controls

What does 320.32 require?

For each deviation found, the auditor looks into what it was and why it happened, then decides whether: the deviations fall within the expected rate and are acceptable, so the tests still support effective operation; further testing of that control or of related controls is required; or the tests show the control failed to work effectively across the whole period.

Maintained by Gerard BlokdykControl text last updated

Other controls in AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls