Since cost of an SSAE16 “audit” is such a big restraining factor, how can you provide assurance without testing all the controls?

This question was asked by an attendee at a recent Proformative SAS 70/SSAE 16 event: Since cost of an SSAE16 “audit” is such a big restraining factor, how can you provide assurance without testing all the controls?