What is in a SAS 70 audit report depends on the type of report being obtained.
In a Type I report, the service auditor will express an opinion on (a) whether the service organization’s description of its controls was accurate and (b) whether the controls were suitably designed to achieve specified control objectives. The report will include sections 1 and 2 below, however sections 3 and 4 are optional.
In a Type II report, the service auditor will express an opinion on the same items noted above in a Type I report, and (c) whether the controls were operating effectively during the period. The report will include sections 1, 2, and 3 below, however section 4 is optional.
Section 1: Service Auditor’s Report – completed by the Auditor and describes the scope of the audit and the includes the opinion of the auditor.
Section 2: Description of Relevant Controls – completed by the company and describes the control environment, process, and systems being audited. Additionally, it includes the controls that the company is not responsible for and which the customer should ensure are in place in their organization.
Section 3: Information Provided by the Service Auditor – completed by the auditor and describes the results of control testing.
Section 4: Other Information Provided by the Service Organization – completed by the company and may include management responses to identified gaps, information on business continuity and disaster recovery, or a glossary of terms used in the audit report