36. Which testing standard is currently used to guide Service Organization Control (SOC) audits outside the United States?
Answer: B
The International Standard on Assurance Engagements (ISAE) 3402 is currently used to guide SOC audits outside the United States.
ISAE 3402 provides a framework for reporting on controls at service organizations and is recognized internationally for its relevance in the context of SOC audits.
A) The Statement on Standards for Attestation Engagements (SSAE) 18
SSAE 18 is primarily applicable within the United States and is used for SOC 1, SOC 2, and SOC 3 reports. Thus, it is not the standard guiding SOC audits outside the U.S., making it incorrect for this context.
B) The International Standard on Assurance Engagements (ISAE) 3402
ISAE 3402 is the correct standard as it is designed specifically for use in the international context of service organization audits. It aligns with the principles of SOC reporting and is recognized globally, thereby making it the appropriate choice for guiding SOC audits outside the United States.
C) The Statement on Standards for Accounting and Review Services (SSARS) 25
SSARS 25 pertains to accounting and review services rather than attestation services related to controls at service organizations. Therefore, it does not apply to SOC audits and is incorrect.
D) The International Standard on Review Engagements (ISRE) 2400
ISRE 2400 focuses on review engagements but does not specifically address the controls at service organizations like ISAE 3402 does. Consequently, it is not applicable for guiding SOC audits and is therefore incorrect.
Conclusion
ISAE 3402 is the definitive standard for guiding SOC audits outside the United States, as it provides a comprehensive framework recognized internationally. The other options are either U.S.-specific or unrelated to the context of service organization audits, confirming that they do not fulfill the requirements of the question.