SOC 18
AICPA SSAE 18 (AT-C 320) attestation on a service organization's controls relevant to user entities' internal control over financial reporting.
Requirements in this framework
- Complementary subservice organization controls
- Control design documentation
- Control objectives for financial reporting
- Exception and remediation governance
- Operating effectiveness evidence
- Scope boundary and system description accuracy
- Testing exception evaluation and reporting
- User entity control considerations