A SAS 70 audit report assesses the design and operating effectiveness of a service organization’s controls.  A Type I SAS 70 only assesses the design of controls.  A Type II SAS 70 assesses both the design and operating effectiveness of controls.

Consider the following scenario – Your company provides a service that may materially affect your customer’s financial statements.  Naturally, your customers, your customer’s auditors, and your potential future customers want to make sure their financial information is accurate, complete, and recorded properly.  As such, each of these parties requests to inquire or audit your processes and systems.  What a nightmare, right?

Well, that is where a SAS 70 comes in.  Since the SAS 70 audit report assesses the design and operating effectiveness of a service organization’s controls, the audit report can be provided to customers as evidence of the effectiveness of your controls.  You may not want to provide the report to potential future customers, but letting them know that you received a clean SAS 70 audit report would certainly provide them some comfort regarding your operations.

So what type of organization would need or even want a SAS 70?  Usually the following organizations would consider obtaining a SAS 70: payroll service providers, claims processors, benefits administrators, third party administrators, clearinghouses, transfer agents, trust administrators, data centers, application service providers (ASPs), and outsourced IT departments.

Here is a pretty good link that provides some more details.

Have your customers requested assurance that your processes and systems are controlled?  
Do you feel comfortable that the business processes and IT processes you have in place are controlled to prevent/detect unnecessary mistakes, unauthorized transactions, unauthorized modifications to data, and fraudulent activity?