SAS 70 Report
Internal control reviews are an important step in making sure all the checks and balances are in place. As outsourcing becomes more common, the need for service organizations to provide their clients with a report on its policies and procedures (commonly known as a SAS 70 report) is increasing. We perform studies of internal controls and SAS 70 engagements for all types of organizations.
To ensure clients the necessary controls are in place to provide for the safety and integrity of their assets, many organizations rely on a Statement of Auditing Standards (SAS) No. 70 – Service Organizations report on the controls supporting your services. Such reports are prepared by a qualified independent accounting and auditing firm in accordance with guidance provided by the American Institute of Certified Public Accountants (AICPA).
Many organizations find that having a SAS 70 report may result in benefits including:
- Increased client confidence
- Minimization of frequent audits
- Enhanced risk management
- Improved competitive advantage
- Streamlined business processes and controls.
What is a SAS 70 Report? A SAS 70 Report is designed to provide information and assurance about controls within a Service Organization to user organizations (its clients) and their auditors. There are two types of SAS 70 reports:
- Type I provides an opinion as to whether the controls described by the Service Organization were suitably designed to achieve specified objectives and whether they have been placed in operation as of a specific date.
- Type II provides an opinion on the two items noted in the Type I report as well as, whether the controls described by the Service Organization were operating effectively throughout a specified period of time, generally 6 to 12months, as tested by the Service Auditor.
Since the Type II report includes testing performed to verify the operational effectiveness of the controls over time, it is more valuable to user organizations and their auditors.