SAS 70 FAQs
Q. What is SAS 70?
A. “Statement on Auditing Standards (SAS) No. 70, Service Organizations, is an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). A SAS 70 audit or service auditor's examination is widely recognized, because it represents that a service organization has been through an in-depth audit of their control activities, which generally include controls over information technology and related processes. In today's global economy, service organizations or service providers must demonstrate that they have adequate controls and safeguards when they host or process data belonging to their customers. In addition, the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 make SAS 70 audit reports even more important to the process of reporting on effective internal controls at service organizations.” source: www.sas70.com.
Q. Is this a new standard?
A. SAS No. 70 was adopted by AICPA as a standard in 1992. However, increased outsourcing and the visibility and effectiveness of internal control requirements introduced in Section 404 of the Sarbanes-Oxley Act (SOX) of 2002 have fueled a renewed interest in SAS 70 examinations.
Q. How has Sarbanes-Oxley impacted the demand for SAS 70 examinations?
A. Sarbanes-Oxley was enacted to rebuild investor's trust in the financial reporting of public companies by increasing the transparency and oversight of corporate financial reporting. Inherently, improved financial reporting assures reliable and robust internal controls throughout an organization's financial systems. SOOX clearly states that the outsourcing of a business process does not relieve the user organization of the responsibility for ensuring that adequate controls over the business process are still in place. As a result many companies are relying on the SAS 70 standard when evaluating the robustness of controls at service organizations. Today, companies need practical assurances that their service providers have implemented appropriate controls over business processes and information technology. A SAS 70 audit is the de facto standard for demonstrating the existence and effectiveness of internal controls at a service organizations.
Q. Can you explain the SAS 70 Audit process in brief?
A. A SAS 70 examination is an audit conducted by a qualified CPA firm that reviews and tests the effectiveness of a service provides internal controls based on the AICPA Statement of Accounting Standards No. 70. When the audit is complete, the Service Auditor's Report will contain:
-
Independent Service Auditor’s Report (audit opinion).
-
Description of Controls in place at the service organization.
-
Description and results of tests for the operating effectiveness of the controls in place.
Q. What is the difference between a SAS 70 Report and a Service Auditor's Report?
A. There is no difference. The terms are interchangeable.
Q. What Types of Entities are candidates for SAS 70 Reviews?
A. Any company that provides information systems and services that handle financial data and/or transactions including organizations that:
- Execute and maintain accountability of transactions.
- Records transactions and processes information.
- Impacts the client’s financial reporting.
Typical service companies include application service providers, managed security providers, trust departments, claims processors, clearing houses, credit processing companies, application service providers, and data hosting facilities.
Q. Are their different types of SAS 70 reports?
A. Yes. There is a Type I and a Type II report.
- A Type I report is issued for a particular date. For example, a CPA firm would examine a company's controls on January 1, 2007 and report (based on inquiry and observation of controls) on the processing of transactions and related controls for that very same date: January 1, 2007.
- A Type II report is issued after a six-month testing period has been completed. For example, A CPA firm would examine a company's controls from January 1, 2006 to July 1, 2006 and report on the processing of transactions and related controls for that same six month period. Unlike a Type I report, a Type II report would also include testing of relevant controls.
Q. How Long is a SAS 70 Report Valid?
A. SAS Type 1 and Type !! reports are valid for one full calendar year from the date of issue.
Q. What are the benefits of a SAS 70 certification when selecting a service provider?
A. An unqualified SAS 70 opinion will affirm the following:
- Provides your company with reasonable assurance that the service organization in question has established internal controls that are operating effectively.
- Provides insight into the nature of the service organization’s controls and an independent party’s assessment of their effectiveness.
- Alleviate the burden and cost of performing your own audit on the service organization.
|
