While working with clients to scope their SSAE 16 engagements, many a times we are asked what is the minimum coverage period for a Type 2 SSAE 16 examination. Let me try and answer that questions and draw some clarity to it.
The SSAE 16 standards require a minimum of a six month reporting period. Paragraph A42 of Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization (AICPA, Professional Standards, AT sec. 801), states that a type 2 report that covers a period of less than six months is unlikely to be useful to user entities and their auditors.