To make your audit documentation workflow compliant with SSAE 18 (AT-C 210 / SSAE 18 reporting standards) using audit platform software, focus on controls, evidence integrity, and reviewability. SSAE 18 is less about the software itself and more about whether your process produces complete, accurate, secure, and retrievable audit evidence.

Here’s a practical checklist:

1) Define and document the workflow

Your platform should support a clear, repeatable process for:

• Engagement setup
• Scope and risk assessment
• Requesting and receiving evidence
• Review and approval
• Exceptions and follow-up
• Final report assembly and retention

Make sure the workflow is documented in your audit methodology or SOPs.

2) Preserve evidence integrity

SSAE 18 expects reliable audit evidence. Your platform should:

• Keep an immutable or version-controlled record of uploaded documents
• Log who uploaded, changed, reviewed, or approved each item
• Prevent silent overwrites
• Retain original file metadata where possible
• Time-stamp all actions

If your platform allows edits, it should preserve prior versions and show a full audit trail.

3) Enforce access controls

Use role-based access so only authorized users can:

• View sensitive workpapers
• Edit evidence
• Approve documentation
• Close engagements

Good practice includes:

• MFA
• Least privilege access
• Segregation of duties between preparer and reviewer
• Periodic access recertification

4) Maintain a complete audit trail

Your system should capture:

• User identity
• Date/time of action
• Type of action performed
• Before/after values for edits
• Approval history
• Evidence request and response history

This supports traceability if your documentation is reviewed later.

5) Standardize workpaper quality

Each workpaper should include:

• Purpose
• Source of evidence
• Procedure performed
• Results
• Exception handling
• Reviewer sign-off

Use templates and required fields so staff cannot submit incomplete workpapers.

6) Control external evidence collection

When using client portals or integrations:

• Verify source authenticity
• Restrict upload types where appropriate
• Scan for tampering or malware
• Record submission date/time and submitter identity
• Link evidence to the exact request or control tested

If evidence comes from third parties, document how you verified its reliability.

7) Retention and archival

SSAE 18 requires documentation retention sufficient to support the engagement and any subsequent review. Your platform should allow:

• Locked final files after report issuance
• Retention policies aligned to your firm’s requirements
• Secure archival and retrieval
• Defensible deletion procedures after retention expires

Don’t rely on users manually preserving files.

8) Review and supervision

The platform should support supervisory review by:

• Routing workpapers for review
• Capturing reviewer comments and resolutions
• Requiring sign-off before closure
• Showing whether issues were cleared

This helps demonstrate engagement quality control.

9) Test the system itself

If the platform is central to your audit evidence process, treat it like a controlled system:

• Validate key configurations
• Test user permissions
• Review log completeness
• Confirm backups and recovery
• Periodically test export/retrieval of records

This helps ensure documentation remains available and reliable.

10) Align with firm policies and legal requirements

SSAE 18 compliance also depends on:

• Your firm’s audit methodology
• Quality management policies
• Professional standards
• Data privacy and confidentiality obligations
• Any contractual retention requirements

Your platform workflow should map to these policies.

---

A simple compliance-focused workflow

A good SSAE 18-aligned process often looks like this:

1. Create engagement
2. Assign roles
3. Generate evidence requests
4. Collect documents in controlled portal
5. Review completeness and authenticity
6. Document testing/results
7. Supervisor review and approval
8. Lock final workpapers
9. Archive with retention policy
10. Retain full audit trail

---

Questions to ask your software vendor

Before relying on the platform, ask whether it provides:

• Immutable audit logs
• Version history
• Role-based access controls
• MFA support
• Review/approval workflows
• Time-stamped activity history
• Secure archival/retention controls
• Exportable logs for inspections
• Evidence integrity controls
• SOC 1 / SOC 2 reports for the vendor environment, if relevant

---

Important note

SSAE 18 compliance is ultimately about the auditor’s procedures and documentation, not just software features. Even a strong platform won’t make the workflow compliant if users:

• Skip reviews
• Fail to document judgments
• Allow uncontrolled file changes
• Don’t retain evidence properly

If you want, I can turn this into a SSAE 18 compliance checklist for audit platform software or a sample SOP/workflow.