SSAE 16 and Confidentiality

I understand the purpose and scope of an SSAE 16 audit and why a company would want to be accredited with one. However, because the audit report contains such confidential information, many companies (Google comes to mind) refuse to provide it to even their most highly regarded customers. Are they obtaining it just to say that they have it? And in circumstances like this, what's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?
askrenesAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
asavenerConnect With a Mentor Commented:
And I'm suggesting that even if they're telling the truth, and they've had a SSAE 16 report issued, it's unclear whether that actually means anything.

SSAE 16 is designed as an auditor-to-auditor report; it is not designed for consumption by the general public, or even a business' customers.



You stated, "I understand the purpose and scope of an SSAE 16 audit and why a company would want to be accredited with one."

I'm saying there is no accreditation.  It's a report, not a credential.
0
 
asavenerCommented:
http://www.ssae16.org/faq/does-our-organization-become-ssae-16-qcertifiedq.html

There is no certification awarded or granted upon completing an SSAE 16 attestation engagement.  Rather, the more technically correct wording one may use it that a service auditor has performed an attestation engagement to report on controls at a service organization, which resulted in the issuance of an SSAE 16 Type 1 or SSAE 16 Type 2 report.
0
 
askrenesAuthor Commented:
That doesn't exactly answer my questions. What's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?
0
All Courses

From novice to tech pro — start learning today.