SSAE 18 - Attestation Standards (SOC Reporting)
AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

SSAE 18 - Attestation Standards (SOC Reporting) 320.38: AT-C 320.38 Written Representations

What does 320.38 require?

For both type 1 and type 2 engagements, the auditor asks the service organisation's management for the written representations even when a different party engaged the auditor; section 205's option of oral representations is not available, and a refusal by the service organisation, or by a subservice organisation included in scope, limits the scope in a way that rules out an unmodified opinion and may justify withdrawing.

Maintained by Gerard BlokdykControl text last updated

Other controls in AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls