Doing a SAS 70 Audit Soon? Here’s What You Need to Know

Many companies will soon be doing a SAS 70 audit, or rather, undertaking a SAS Type I or Type II audit. There are a number of important considerations to take into account when beginning the SAS 70 audit process. First and foremost, make sure you pick a qualified CPA firm that has the knowledge and expertise to conduct the audit. Sounds easy, right? Well, it should be based on the large number of providers available just by searching on Google.

But what about price, audit scope, scheduling, along with many other important audit considerations. This is where the black and white can turn into unclear, murky answers.

SAS 70 pricing, be it for Type I and Type II audits, quite frankly, is all over the board. And why? Because of the large number of players currently conducting these audits. From the traditional Big Four accounting firms to small, sole practitioner entities, it seems like everybody is getting into the game. And that’s fine, as competition “should” result in expert services for fair, equitable fees. I stress “should” because some CPA firms do not seem to have the expertise or manpower to conduct the audits properly. So, what can you expect to pay? Again, it all depends on who the proposals are coming from. If from the Big Four, expect those to be the highest. Next in line are the non-Big Four, but still nationally known firms. Further down the line are the boutique specialized firms, such as NDB, Accountants and Consultants.

Nevertheless, if you’re going to be doing a sas 70 audit, make sure you cover the “finer” points when you begin the process. Address these major issues in an adequate manner and all should be well with the audit.

• Get a grip on the scope of the audit. Find out what’s included and what isn’t. Talk to your clients who are requesting this report to make sure that everyone is on the same page.
• Once you find a provider, make sure the price is fair and equitable. As I said earlier, pricing for SAS 70 audits are all over the board.
• Make sure a SAS 70 Roadmap for Compliance has been developed, which should outline the major deliverables, milestones, and activities for the audit.
• Get a commitment from the CPA firm to complete the audit on time, which includes the final delivery of the report and other notable areas for the audit. Auditors can procrastinate, so a commitment from them is necessary.

Lastly, if you are doing a sas 70 audit or plan on undertaking one soon, a sas 70 download available option is provided at sas70.us.com. It gives readers an excellent example of what a final SAS 70 Type II report should look like.