Riskassuranceguy.com Website Review

here's a de*p question.  now that ssae 16 is obsolete, what brand will the aicpa promote?  is it an ssae 18 report for all reports that are not soc 1 or soc 2?  or should all ssae 18 reports be either soc 1 or soc 2?  know, magneto's nemesis, professor x, has the ability to read minds, and in order to protect his thoughts from being intercepted, magneto wears a helmet made of lead.  magneto and professor x are not real, and neither is the ability to read minds, but judging by many of the controls i see in ssae 16 reports that are supposed to contain only controls that mitigate the risk of material financial misstatement, i would not be surprised to see a control such as we use lead-lined drywall recently i have had opportunities to observe several auditors defend why they believe the controls contained in their client's ssae 16 reports are relevant to internal controls over financial reporting (icfr).  the auditors argue that the risk events the controls mitigate are possible.  i have had to explain, to seasoned auditors in some cases, that just because a risk event is possible, does not mean it is reasonable to conclude a control is icfr relevant.  i mean, sure, some people believe in psychics, and there is probably anecdotal evidence out there that pas*word sniffing via psychic is possible, but is jumping from there to a control requirement for lead-lined drywall reasonable?  of course not.  it is equally unreasonable to say that having fire suppression in your data center will prevent you from materially misstating your financials. do we really need to explain that physical security, environmental, and operational controls do not belong in ssae 16 reports, or is there something more sinister going on?  why haven't auditors required their clients to remove non-icfr controls from their ssae 16 reports since the launch of soc reports?  could it be that the number of controls that require testing in an audit program directly relate to