The SSAE 18 process is predictable once you know the sequence. Below is the standard path, with references to the specific control areasSSAE 18 auditors focus on.
Typical end-to-end timeline: 3 – 9 months.
Step 1 — Scoping
Define exactly what's in scope: product lines, systems, offices, subsidiaries, and third-party processors. Over-scoping is the single biggest cause of SSAE 18 cost blowouts; under-scoping risks a scope gap at audit time.
Step 2 — Gap Assessment
Compare your current state against the SSAE 18 control set and produce a gap register. Teams typically run this with either an internal lead or a readiness-focused consultant.
Control areas you'll be assessed on
- AT-C Section 105: Concepts common to all attestation engagements
- AT-C Section 205: Examination engagements
- AT-C Section 210: Review engagements
- AT-C Section 215: Agreed-upon procedures
- AT-C Section 320: Reporting on service organization controls (SOC 1)
- AT-C Section 205 applied to SOC 2 and SOC 3
Step 3 — Remediation
Close the gaps. In practice this is a mix of:
- Technical implementation — MFA, logging, encryption, access reviews, backups, vulnerability management.
- Policy and documentation — information security policy, incident response plan, risk register, data classification, vendor management.
- Process adoption — change tickets with approvals, periodic access reviews, management review meetings, awareness training.
Step 4 — Audit Readiness Review
Many teams run a pre-audit assessment with their chosen auditor (Stage 1 for ISO-family frameworks, readiness assessment for SOC- family). Fix the findings before the formal audit; a nonconformity on the final report is harder to clear.
Step 5 — Formal Audit
Annual reports are standard practice. Type 2 reports cover a minimum observation period defined by the engagement.. Expect interviews, evidence requests, and walk-throughs. Keep an evidence tracker open throughout — you'll be asked to produce everything from HR records to firewall configs.
Step 6 — Ongoing Maintenance
SSAE 18 is not a one-off. Plan for annual surveillance audits (or an annual Type II window), periodic management reviews, and evidence collection as a continuous process rather than a sprint before each audit.
Common Pitfalls
- Scope creep during the engagement. Freeze scope at kickoff.
- Policy without practice. Auditors verify behavior, not just documents.
- Last-minute evidence hunts. Evidence should be collected continuously, not scrambled for the audit window.
For cost breakdowns and budget tiers, see the cheapest path to SSAE 18. For when it's worth it, see when and why to pursue SSAE 18.