Archive for the ‘SAS 70’ Category

« Older Entries

Changes to SAS 70 Auditing Standard

Thursday, June 3rd, 2010

SAS 70 is an auditing standard put forth by the AICPA that is utilized by auditors for examining internal controls in service organizations. Service organizations include: business process outsourcing (payroll, general accounting), data centers, outsourced IT functions, software providers, claim processors, benefit plan administrators, trust administrators, investment advisors, and billing and collections companies.

As part of its project to converge with International Auditing and Assurance Standards Board (IAASB) standards, the AICPA issued SSAE No. 16, which will be effective for reporting periods on or after June 15, 2010.

The new standards include a number of changes for both auditors and companies obtaining SAS 70 audit reports. Two changes that service organizations should be aware of include:

-       The auditor will be required to document the criteria used when auditing a service providers internal controls.
-       The company will be required to provide a written assertion on the subject matter of the engagement.

If you are a service provider with questions on internal control reports or SAS 70 reports, please feel free to contact Scott McAuliffe, Keiter Stephens’ Principal in charge of Risk Advisory Services, at 804-273-6247 or smcauliffe (at) kshgs (dot) com.

Tags: ,
Posted in SAS 70 | No Comments »

What’s in a SAS 70?

Wednesday, June 10th, 2009

What is in a SAS 70 audit report depends on the type of report being obtained.

In a Type I report, the service auditor will express an opinion on (a) whether the service organization’s description of its controls was accurate and (b) whether the controls were suitably designed to achieve specified control objectives.  The report will include sections 1 and 2 below, however sections 3 and 4 are optional.

In a Type II report, the service auditor will express an opinion on the same items noted above in a Type I report, and (c) whether the controls were operating effectively during the period.  The report will include sections 1, 2, and 3 below, however section 4 is optional.
Section 1: Service Auditor’s Report – completed by the Auditor and describes the scope of the audit and the includes the opinion of the auditor.

Section 2: Description of Relevant Controls – completed by the company and describes the control environment, process, and systems being audited.  Additionally, it includes the controls that the company is not responsible for and which the customer should ensure are in place in their organization.

Section 3: Information Provided by the Service Auditor – completed by the auditor and describes the results of control testing.

Section 4: Other Information Provided by the Service Organization – completed by the company and may include management responses to identified gaps, information on business continuity and disaster recovery, or a glossary of terms used in the audit report

See more posts on SAS 70

Tags: , , , ,
Posted in SAS 70 | No Comments »

Benefits of a SAS 70

Wednesday, June 10th, 2009

We’ve talked about SAS 70s in previous posts (What is SAS 70 and who needs it? and Types of SAS 70 Services), but where will your organization see a real benefit?

Efficiency and Cost Reduction – Your company can have one audit performed and provide one report to interested parties.  This allows your company to focus on what it does best and reduces the time required to respond to audit inquiries.

Piece of Mind – It makes good business sense to make sure you have controls in place to prevent/detect unnecessary mistakes, unauthorized transactions, unauthorized modifications to data, and fraudulent activity.  Having an independent party assess your processes and systems can provide a level of assurance that may be unattainable through self assessment.

Strengthen Existing Relationships – Customers value transparency and assurance that your processes and systems are sound.

Attract Customers – New customers want to know that they will be working with a company that has standards in place and has been reviewed by an independent party.

Differentiate from Competitors – If your company has a clean audit opinion and your competitors don’t or don’t have an audit opinion at all, you should stand out in the marketplace.

Compliance – There may be overlapping regulations that a SAS 70 may meet.  The Sarbanes Oxley Act requires your customers to have controls over financially material processes and systems. The Graham Leach Bliley Act requires financial institutions to provide security over customer information to safeguard their privacy.

Are you interested in strengthening existing relationships, attracting new customers and differentiating your company from competitors?

Do you want to reduce the time and cost of audit inquiries?

Tags: , , , , , , , ,
Posted in SAS 70 | No Comments »

« Older Entries