SSARS vs SSAE: Scope, Assurance Levels, and SOC Reports

SSARS and SSAE are two separate sets of professional standards issued by the AICPA, and the difference between SSARS and SSAE comes down to what the CPA is reporting on. SSARS (Statements on Standards for Accounting and Review Services) governs work on financial statements for nonpublic companies: preparation, compilation, and review. SSAE (Statements on Standards for Attestation Engagements) governs attestation work on other subject matter, such as internal controls, regulatory compliance, or cybersecurity practices, evaluated against defined criteria. Each standard dictates different procedures, different reports, and different levels of assurance for the person relying on the result.

What SSARS Covers

SSARS is codified in the AR-C sections of AICPA Professional Standards and applies when an accountant is engaged to prepare, compile, or review financial statements for a nonpublic entity.¹ The AR-C designation was introduced with SSARS No. 21, which clarified and recodified the body of accounting and review standards.²

Most SSARS work involves historical financial statements such as balance sheets and income statements, but the standards also reach other financial information (budgets and projections, for example) when an accountant prepares or compiles it. The three tiers of SSARS service each carry different responsibilities and deliver different things to the client.

Preparation

Preparation is the most basic SSARS service. The accountant puts management’s data into proper financial statement format. No report is issued and no assurance is provided. The accountant is not verifying the numbers or investigating whether they make sense. Small businesses that need clean statements for a bank or for internal planning often use preparation engagements because they cost less and no formal accountant’s report is required.

Compilation

A compilation increases the accountant’s involvement but is still not an assurance engagement. The accountant applies accounting and financial reporting expertise to help management present the statements, but does not verify accuracy, gather evidence, or express an opinion.¹ Unlike preparation, a compilation requires a written report. The report must state that the accountant did not audit or review the statements and does not express an opinion, a conclusion, or any form of assurance. It must also identify management as the party responsible for the statements.

Review

A review is the most intensive service under SSARS. The accountant performs analytical procedures and inquiries to obtain limited assurance that no material modifications are needed for the financial statements to conform with the applicable reporting framework.¹ Analytical procedures evaluate financial information by examining relationships among the data. Inquiries mean asking management and other knowledgeable people about the company’s financial position. If something looks off, the accountant designs additional work to resolve the concern. A review falls well short of an audit in scope but gives readers meaningfully more confidence than a compilation.

Independence rules differ between the tiers. For a compilation, the accountant does not need to be independent from the client; if independence is impaired, the accountant discloses that fact in the report and can still perform the work. For a review, the accountant must be independent, because limited assurance depends on objectivity. If a CPA discovers during a review engagement that independence has been lost, the engagement cannot continue as a review.³

What SSAE Covers

SSAE is codified in the AT-C sections of AICPA Professional Standards and applies to attestation engagements for nonissuers, meaning companies not publicly traded or otherwise subject to PCAOB standards.⁴ Where SSARS focuses on financial statements, SSAE applies when a practitioner evaluates some other subject matter against specific criteria and issues a formal report on the results. Common examples include a company’s internal controls, its compliance with regulations, and its cybersecurity practices.

SSAE provides for three engagement types, each delivering a different level of assurance.

Examination

An examination is the highest level of attestation service. The practitioner gathers sufficient evidence to express an opinion on whether the subject matter meets the stated criteria. It is the attestation equivalent of an audit, applied to non-financial-statement topics. SSAE No. 21 also introduced a direct examination option, letting the practitioner measure or evaluate the underlying subject matter directly rather than only evaluating a written assertion from the responsible party.⁵

Review

An SSAE review provides a lower level of service than an examination. The practitioner performs inquiry and analytical procedures to obtain limited assurance about whether the subject matter meets the criteria. SSAE No. 22 clarified that the purpose of a review engagement is obtaining limited assurance, not simply running procedures and asking questions.⁶ The conclusion is framed in the negative: nothing came to the practitioner’s attention indicating the subject matter is materially misstated.

Agreed-Upon Procedures

In an agreed-upon procedures engagement, the practitioner performs only the specific tasks the engaging party agrees to. The report describes exactly what was done and what was found. No opinion is expressed and no assurance is provided. This is the most customizable SSAE engagement and fits targeted checks like verifying inventory counts, confirming specific contract terms, or testing a narrow compliance question. SSAE No. 19 added flexibility by allowing procedures to be developed during the engagement and permitting the practitioner to help design them, rather than requiring everything to be locked in before work begins.⁴

Key Differences at a Glance

The simplest way to keep the two straight: SSARS is about financial statements, SSAE is about everything else a CPA formally reports on. Several other distinctions matter in practice.

Codification: SSARS uses AR-C sections; SSAE uses AT-C sections. An AR-C reference means accounting and review standards apply; AT-C means attestation.
Subject matter: SSARS engagements deal with financial statements and related financial information. SSAE engagements evaluate other subject matter against defined criteria.
Applicability: Both apply to nonpublic entities. Public companies fall under PCAOB standards for audits, though their service organizations may still receive SOC reports performed under SSAE.⁴
Service tiers: SSARS provides preparation, compilation, and review. SSAE provides examination, review, and agreed-upon procedures. The word “review” appears in both, but the subject matter differs.
Independence: Under SSARS, a compilation can be performed without independence if the accountant discloses the impairment. Under SSAE, the practitioner generally must be independent for examination and review engagements.

Levels of Assurance

Assurance is the practical difference the reader of a report feels. The level determines how much confidence the report supports.

Reasonable assurance: The highest level, provided by an examination (or an audit). The practitioner expresses a positive opinion that the subject matter is fairly presented in all material respects. This is not certainty; it means the risk of a material misstatement going undetected has been reduced to an acceptably low level.
Limited assurance: Provided by a review engagement under either SSARS or SSAE. The practitioner expresses a negative conclusion: nothing came to their attention indicating material modifications are needed. Less evidence is gathered than in an examination, so more residual risk remains.
No assurance: Provided in a compilation, a preparation, or an agreed-upon procedures engagement. A compilation delivers organized financial statements with a report attached. Agreed-upon procedures deliver a factual description of findings. Neither report tells the reader the information is reliable.

Knowing which level backs a report is the single most important thing when you are on the receiving end. A SOC 2 Type II examination delivers reasonable assurance about a vendor’s controls. A compilation report delivers none. Treating them as interchangeable is a due diligence mistake.

Where SSARS and SSAE Overlap

The two standards intersect on prospective financial information. Preparing or compiling a financial projection can fall under SSARS, while an examination or agreed-upon procedures engagement on that same projection would fall under SSAE.⁷ The type of service determines which standard applies, not the nature of the underlying data.

SOC Reports: SSAE in Everyday Practice

The most widely recognized application of SSAE is the System and Organization Controls (SOC) suite of reports.⁸ If a company uses cloud software or outsources any function that touches sensitive data, SOC reports usually surface during vendor due diligence. All SOC examinations are attestation engagements performed under SSAE, with the CPA following AT-C examination requirements and expressing an opinion on the service organization’s controls.

Three SOC report types serve different audiences:

SOC 1 focuses on a service organization’s internal controls over financial reporting. If a vendor handles transactions that could affect a customer’s financial statements (payroll processing, for example), a SOC 1 report evaluates whether those controls are designed and operating effectively.⁹
SOC 2 evaluates controls related to information security using the AICPA’s Trust Services Criteria. Those criteria cover five categories: security (mandatory for every SOC 2), availability, processing integrity, confidentiality, and privacy. SOC 2 is the report most SaaS companies and data-handling vendors pursue.¹⁰
SOC 3 covers the same ground as SOC 2 in a summarized, general-use format. Companies often post SOC 3 reports publicly because, unlike SOC 2 reports, they do not contain detailed descriptions of specific controls.

Both SOC 1 and SOC 2 come in two varieties. A Type I report evaluates whether controls are properly designed at a single point in time. A Type II report tests whether those controls actually operated effectively over a period, usually three to twelve months. Type II carries more weight with sophisticated users because it shows sustained performance rather than a snapshot. When evaluating a vendor’s SOC report, check whether it is Type I or Type II before drawing conclusions about the control environment.

1
AICPA & CIMA. AICPA SSARSs – Currently Effective
2
AICPA & CIMA. AICPA Statement on Standards for Accounting and Review Services No. 21
3
AICPA & CIMA. What Is the Difference Between a Compilation, Review, and Audit?
4
AICPA & CIMA. AICPA SSAEs – Currently Effective
5
AICPA & CIMA. AICPA Statement on Standards for Attestation Engagements No. 21
6
AICPA & CIMA. SSAE No. 22, Revisions to Attestation Review Standard for Clarity on Procedures, Report Transparency and Consistency With Other Professional Standards
7
AICPA & CIMA. Prospective Financial Information Guide
8
AICPA & CIMA. System and Organization Controls: SOC Suite of Services
9
AICPA & CIMA. SOC 1 – SOC for Service Organizations: ICFR
10
AICPA & CIMA. 2017 Trust Services Criteria (With Revised Points of Focus – 2022)